SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
CVE-2026-73054
Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity. The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream. Details The exemption matches substrings. kernel/server/serve.go:1222 on the development branch, :1074 on master: go authOk = strings.Contains(s.Request.RequestURI, "/ws?app=siyuan") && strings.Contains(s.Request.RequestURI, "&id=auth&type=auth") Neither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to. The quarantine parses. Commit 1e370e373 added the containment for exempted sessions at kernel/util/websocket.go:171: go id = session.Request.URL.Query().Get("id") return "auth" == id…
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 0.00539% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- go · github.com/siyuan-note/siyuan/kernel
- Weakness
- CWE-287
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
At the source
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83
- https://nvd.nist.gov/vuln/detail/CVE-2026-73054
- https://github.com/siyuan-note/siyuan/commit/67bc300b6ea6650d99dae55c827aeced419c8ac4
- https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4
- https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-websocket
- https://github.com/advisories/GHSA-c8w8-3pqp-wr83
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-73054