Threats tagged 'ghsa-9f49-xx3h-chx9'

SiYuan versions prior to 3.8.4 have an authentication bypass vulnerability in the publish service. Session cookies are transmitted without Secure or SameSite attributes over plaintext HTTP, allowing an attacker on the network path to capture and replay a valid session cookie to access authenticated publish endpoints without the account password. This issue is fixed in version 3.8.4.