{"id":"EUVD-2026-59803","revision":"ba1bd61c1205431daad9d53b34eebf75","records":[{"revision":"ba1bd61c1205431daad9d53b34eebf75","observedAt":"2026-10-30T11:52:36.961+00:00","statement":{"source":"euvd","id":"EUVD-2026-59803","aliases":["CVE-2026-73054","GHSA-hg5w-8ppq-wpjq","GHSA-c8w8-3pqp-wr83"],"title":"SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attack…","description":"SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83","https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-websocket"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59803","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 15, 2026, 9:44:53 PM","dateUpdated":"Aug 17, 2026, 5:25:30 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-59803","identifiers":["EUVD-2026-59803","CVE-2026-73054","GHSA-hg5w-8ppq-wpjq","GHSA-c8w8-3pqp-wr83"]},"retained":false,"historicalAffected":[]}],"coverage":[]}