Description
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.6.0 – < 3.8.7 | 3.8.7 |