CVE-2026-116167

SiYuan versions 2.9.0 before 3.8.7 are vulnerable to a cross-site scripting (XSS) flaw on the unauthenticated /check-auth page. The root cause is a lack of scheme validation when the application assigns the to parameter to window.location.href. An attacker can provide a crafted link using a javas...