Is CVE-2026-100635 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100635?

CVE-2026-100635 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-100635

Description

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.