Technical impact
SiYuan 3.6.0 to 3.8.6 accepts the networkServeTLS configuration but does not enforce it, causing the kernel port to serve the full API over both HTTPS and plain HTTP. The login flow and session cookie are transmitted in cleartext, the cookie lacks a Secure attribute, and responses omit HSTS. This allows an attacker to capture the credentials and session identifier, leading to unauthorized session hijack.
Affected Systems
SiYuan note version 3.6.0 through 3.8.6 released by siyuan-note is affected. The vulnerability exists before the 3.8.7 release that corrects the enforcement of TLS.
Risk and Exploitability
The CVSS score of 7.6 indicates a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can sniff traffic on the same network segment can observe the cleartext login exchange and cookie, then reuse the cookie to impersonate the authenticated user. Because the traffic is not protected by TLS, the window for exploitation is large and the impact is significant, though the attacker needs network proximity rather than remote access.
