CVE-2026-73054 describes an authentication bypass vulnerability in SiYuan versions before 3.7.4. The issue is due to differential parsing of duplicated query parameters in the WebSocket endpoint, which causes the authentication exemption and session quarantine checks to be inconsistent. An attacker can craft a malicious WebSocket URI with duplicated parameters to bypass the access authentication code validation. This allows unauthorized access to the live kernel event stream, exposing document identifiers, titles, and operation logs.

Unauthenticated attackers can bypass authentication controls on the WebSocket endpoint and access sensitive live event data including document identifiers, titles, and operation logs. This exposure could lead to information disclosure of potentially sensitive user data. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.7.4, upgrading to version 3.7.4 or later is implied but not explicitly confirmed as a fix. Monitor vendor communications for an official patch or workaround.