CVE-2026-73046

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

August 16, 2026

Last Seen

August 17, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Authentication Bypass Vulnerability in SiYuan (CVE-2026-73046)76.5

A critical vulnerability (CVE-2026-73046) has been identified in SiYuan versions prior to 3.7.4, allowing unauthenticated remote attackers to exploit improper authentication restrictions in the CheckAuth() middleware. The flaw enables brute-force attacks on the admin access code via HTTP Basic Authe...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Authentication Bypass Vulnerability in SiYuan (CVE-2026-73046)

Aug 16·1 sources

Related Articles (4)

CVE-2026-73046 - SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth Latest Vulnerabilities / 1d CVE ID : CVE-2026-73046 Published : Aug. 15, 2026, 10:16 p.m. 6 hours, 18 minutes ago Description : SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consult

cvefeed.io·Aug 17

CVE-2026-73046 INCIBE-CERT - Vulnerabilities RSS / 1d The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.

www.incibe.es·Aug 17

CVE-2026-73046: SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth [CRITICAL] CVSS 9.3 Exploit Intelligence — Recent CVEs / 1d SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by

exploit-intel.com·Aug 17

CVE-2026-73046 - Exploits & Severity

Related Entities

Brute Force SiYuan CWE-287 - Improper Authentication CWE-307 - Improper Restriction of Excessive Authentication Attempts T1110 - Brute Force