The vulnerability is a classic Authentication Bypass where session cookies are issued without Secure or SameSite attributes over plain HTTP. An attacker who can observe network traffic can capture the publish‑visitor‑session‑id cookie granted during a Basic Auth interaction and replay it to gain authorized access to publish endpoints without needing the target account password. This flaw essentially nullifies the login mechanism and represents a significant compromise of data confidentiality and integrity.

SiYuan (the Siyuan note application) versions earlier than 3.8.4 are affected. The issue resides in the publish service component of the software, which generates the session cookie without proper security flags.

The CVSS score of 8.2 indicates high severity, while the EPSS score is not provided and the vulnerability is not listed in CISA KEV. The likely attack vector is an on‑path or man‑in‑the‑middle attacker who can tap into an HTTP session. Once the attacker has seen the valid cookie from a Basic Auth exchange, replaying that cookie to the publish API grants authenticated access. This condition does not require privileged system access; it only requires network connectivity to the vulnerable service.