SiYuan HTTP Basic Auth brute-force bypass — no lockout on /api/*
SiYuan's CheckAuth() middleware guards the /api/* surface via HTTP Basic Auth but never applies rate limiting or failure counting, allowing unauthenticated remote attackers to brute-force the admin access code.
- Vendor
- SiYuan
- Product
- SiYuan (all versions before 3.7.4)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The CheckAuth() middleware in SiYuan’s /api/* HTTP surface accepts the workspace access code as an HTTP Basic Auth password but never consults the CAPTCHA gate or increments the session-login failure counter. Unauthenticated remote attackers can submit unlimited automated authentication attempts with no rate limiting, lockout, or CAPTCHA enforcement.
Affected versions: All SiYuan releases before v3.7.4.
Patch: Update to SiYuan v3.7.4. After patching, rotate the workspace access code if the instance was network-accessible.
NVD record: CVE-2026-73046
