GHSA-C8W8-3PQP-WR83
Vulnerability from github – Published: 2026-10-23 18:34 – Updated: 2026-10-23 18:34Summary
Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.
The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.
Details
The exemption matches substrings. kernel/server/serve.go:1222 on the development branch, :1074 on master:
authOk = strings.Contains(s.Request.RequestURI, "/ws?app=siyuan") &&
strings.Contains(s.Request.RequestURI, "&id=auth&type=auth")
Neither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to.
The quarantine parses. Commit 1e370e373 added the containment for exempted sessions at kernel/util/websocket.go:171:
id = session.Request.URL.Query().Get("id")
return "auth" == id
url.Values.Get returns the first value for a repeated key.
The differential. For the URI:
/ws?app=siyuan&id=main&type=main&id=auth&type=auth
- It contains
/ws?app=siyuanand&id=auth&type=auth, soauthOkis true. No cookie, no JWT and no access auth code are required. Query().Get("id")returnsmain, soIsAuthSessionis false.AddPushChanfiles the session insessions, the broadcast pool, rather than inauthSessions.Query().Get("type")returnsmain, so the session matchesBroadcastByType("main", ...).- Without a valid
X-Auth-Tokenthe publish flag is never set, soisPublishSession()does not exclude it either.
Every guard that should have caught the session keys off a different parse than the one that admitted it.
No origin validation. CheckOrigin does not appear on the /ws path, so the cross-origin vector described in the parent advisory also remains available.
Distinction from the existing broadcast-pool advisory. GHSA-mw8r-mw84-88v2 concerns the publish port, where an anonymous session is expected to connect and the defect is that broadcast content is not gated for it afterwards. This report concerns the kernel port with an access auth code configured, where the session should never be admitted in the first place. The leaked data overlaps because both end in the same broadcast pool, but the mechanisms and the affected deployments are different, and gating publish sessions does not close this path.
Proof of Concept
Kernel port, --accessAuthCode set. Three WebSocket connections, none carrying credentials of any kind.
| Socket | Query | Result |
|---|---|---|
| A, baseline | ?app=siyuan&id=main&type=main |
Rejected, closed 1002, 0 frames |
| B, control | ?app=siyuan&id=auth&type=auth |
Connects, 0 frames |
| C, attack | ?app=siyuan&id=main&type=main&id=auth&type=auth |
Connects, 19 to 30 frames across two runs |
Socket A establishes that the access auth code is enforced. Socket B establishes that the existing quarantine works exactly as intended, admitting the keepalive session but delivering nothing to it. Socket C differs from B only in the duplicated parameters, and receives the event stream.
Frames observed on socket C included savedoc ("action":"create","data":{"Root":{"ID": ...), transactions ("action":"updateAttrs" carrying document titles), filetreeSortChanged (the notebook's complete ordered childIDs), create (a notebook object including its name), and backgroundtask.
A canary string placed inside a document body did not appear in any frame, on a full-text search of all captured frames.
Impact
An unauthenticated remote caller obtains the kernel's live event stream on a deployment protected by an access auth code, with no user interaction and no prior knowledge of the instance.
Precisely what is disclosed: document identifiers and titles, notebook identifiers and names, file paths, the complete ordered child structure of notebooks, and the full stream of create, update and delete operations as they occur. Document body content is not present in the observed frames.
That set corresponds to the disclosure claimed by GHSA-xp2m-98x8-rpj6, which means the remediation for that advisory is bypassable rather than incomplete in scope. The absence of origin validation on the endpoint additionally preserves the cross-origin reachability described there.
Confidentiality only. No frames observed permitted writes.
Suggested fix
Make both checks agree, and stop re-parsing attacker-controlled input after admission.
- In the exemption, parse the query rather than matching substrings, and require
idandtypeeach to equalauthexactly. - Reject requests carrying duplicated query keys on this endpoint, so no URI can present two identities.
- Record the exemption as a flag on the session at connect time, and have
IsAuthSessionread that flag rather than re-parsing the request. A session admitted under the keepalive exemption is then quarantined by construction, independent of how its URI is read later.
Adding origin validation to /ws would additionally close the cross-origin vector.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260731131820-67bc300b6ea6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73054"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-23T18:34:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nTwo checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go\u0027s `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.\n\nThe result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.\n\n### Details\n\n**The exemption matches substrings.** `kernel/server/serve.go:1222` on the development branch, `:1074` on master:\n\n```go\nauthOk = strings.Contains(s.Request.RequestURI, \"/ws?app=siyuan\") \u0026\u0026\n strings.Contains(s.Request.RequestURI, \"\u0026id=auth\u0026type=auth\")\n```\n\nNeither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to.\n\n**The quarantine parses.** Commit `1e370e373` added the containment for exempted sessions at `kernel/util/websocket.go:171`:\n\n```go\nid = session.Request.URL.Query().Get(\"id\")\nreturn \"auth\" == id\n```\n\n`url.Values.Get` returns the first value for a repeated key.\n\n**The differential.** For the URI:\n\n```\n/ws?app=siyuan\u0026id=main\u0026type=main\u0026id=auth\u0026type=auth\n```\n\n- It contains `/ws?app=siyuan` and `\u0026id=auth\u0026type=auth`, so `authOk` is true. No cookie, no JWT and no access auth code are required.\n- `Query().Get(\"id\")` returns `main`, so `IsAuthSession` is false. `AddPushChan` files the session in `sessions`, the broadcast pool, rather than in `authSessions`.\n- `Query().Get(\"type\")` returns `main`, so the session matches `BroadcastByType(\"main\", ...)`.\n- Without a valid `X-Auth-Token` the publish flag is never set, so `isPublishSession()` does not exclude it either.\n\nEvery guard that should have caught the session keys off a different parse than the one that admitted it.\n\n**No origin validation.** `CheckOrigin` does not appear on the `/ws` path, so the cross-origin vector described in the parent advisory also remains available.\n\n**Distinction from the existing broadcast-pool advisory.** GHSA-mw8r-mw84-88v2 concerns the publish port, where an anonymous session is expected to connect and the defect is that broadcast content is not gated for it afterwards. This report concerns the kernel port with an access auth code configured, where the session should never be admitted in the first place. The leaked data overlaps because both end in the same broadcast pool, but the mechanisms and the affected deployments are different, and gating publish sessions does not close this path.\n\n### Proof of Concept\n\nKernel port, `--accessAuthCode` set. Three WebSocket connections, none carrying credentials of any kind.\n\n| Socket | Query | Result |\n|---|---|---|\n| A, baseline | `?app=siyuan\u0026id=main\u0026type=main` | Rejected, closed 1002, 0 frames |\n| B, control | `?app=siyuan\u0026id=auth\u0026type=auth` | Connects, 0 frames |\n| C, attack | `?app=siyuan\u0026id=main\u0026type=main\u0026id=auth\u0026type=auth` | Connects, 19 to 30 frames across two runs |\n\nSocket A establishes that the access auth code is enforced. Socket B establishes that the existing quarantine works exactly as intended, admitting the keepalive session but delivering nothing to it. Socket C differs from B only in the duplicated parameters, and receives the event stream.\n\nFrames observed on socket C included `savedoc` (`\"action\":\"create\",\"data\":{\"Root\":{\"ID\": ...`), `transactions` (`\"action\":\"updateAttrs\"` carrying document titles), `filetreeSortChanged` (the notebook\u0027s complete ordered `childIDs`), `create` (a notebook object including its `name`), and `backgroundtask`.\n\nA canary string placed inside a document body did not appear in any frame, on a full-text search of all captured frames.\n\n### Impact\n\nAn unauthenticated remote caller obtains the kernel\u0027s live event stream on a deployment protected by an access auth code, with no user interaction and no prior knowledge of the instance.\n\nPrecisely what is disclosed: document identifiers and titles, notebook identifiers and names, file paths, the complete ordered child structure of notebooks, and the full stream of create, update and delete operations as they occur. Document body content is not present in the observed frames.\n\nThat set corresponds to the disclosure claimed by GHSA-xp2m-98x8-rpj6, which means the remediation for that advisory is bypassable rather than incomplete in scope. The absence of origin validation on the endpoint additionally preserves the cross-origin reachability described there.\n\nConfidentiality only. No frames observed permitted writes.\n\n### Suggested fix\n\nMake both checks agree, and stop re-parsing attacker-controlled input after admission.\n\n1. In the exemption, parse the query rather than matching substrings, and require `id` and `type` each to equal `auth` exactly.\n2. Reject requests carrying duplicated query keys on this endpoint, so no URI can present two identities.\n3. Record the exemption as a flag on the session at connect time, and have `IsAuthSession` read that flag rather than re-parsing the request. A session admitted under the keepalive exemption is then quarantined by construction, independent of how its URI is read later.\n\nAdding origin validation to `/ws` would additionally close the cross-origin vector.",
"id": "GHSA-c8w8-3pqp-wr83",
"modified": "2026-10-23T18:34:09Z",
"published": "2026-10-23T18:34:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73054"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/67bc300b6ea6650d99dae55c827aeced419c8ac4"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-websocket"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.