CVE-2026-73056

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...

CVE-2026-73056

creationtimestamp| type| source ---|---|--- 2026-08-16 13:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117105428138280687 2026-08-16 13:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mt7cbccnrj24 2026-08-16 13:50:06+00:00| seen|...

CVE-2026-73056

SiYuan kernel versions prior to 3.7.4 are affected by an unthrottled brute-force vulnerability in CheckAuth() that allows unauthenticated remote attackers to repeatedly guess the API token (via Authorization header or ?token=) without CAPTCHA/lockout, potentially gaining full RoleAdministrator ac...

CVE-2026-73056 SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...