Session Hijacking Vulnerability in SiYuan Note Application

CVE-2025-68948

What is CVE-2025-68948?

The SiYuan Note application, a self-hosted and open source personal knowledge management tool, has a vulnerability in its session management. In versions 3.5.1 and earlier, the application employs a hardcoded cryptographic secret for its session store, compromising the effectiveness of session encryption. Sensitive information, specifically the AccessAuthCode, is stored within the session cookie. If an attacker intercepts or acquires a user's encrypted session cookie, they can exploit this vulnerability to decrypt the cookie locally using a public key. This gives the attacker access to the AccessAuthCode in plain text, potentially enabling them to hijack or take over the session.

References