![CVE-2026-73046: SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth [CRITICAL] CVSS 9.3 Exploit Intelligence — Recent CVEs / 1d SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by](https://exploit-intel.com/og.png)
Back exploit-intel.com CVE-2026-73046: SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth [CRITICAL] CVSS 9.3 Exploit Intelligence — Recent CVEs / 1d SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
Default status: unaffected
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
