CAPTCHA Bypass Vulnerability in SiYuan by SiYuan Note

CVE-2026-126265

What is CVE-2026-126265?

SiYuan versions prior to 3.8.9 contain a significant flaw related to the login authentication mechanism. The CAPTCHA challenge is stored within a signed client-side cookie, which can be reused by attackers. This vulnerability enables malicious actors to replay the original signed cookie while submitting incorrect access codes, facilitating brute-force attacks to gain unauthorized administrator access. It highlights the importance of securing cookie-based authentication methods.

References