CVE-2026-100635: Cleartext Transmission of Sensitive Information

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

PT-2026-99306

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An authentication bypass exists in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid...