SiYuan versions prior to 3.7.4 expose encrypted‑notebook key‑derivation data and wrapped data keys through unauthenticated endpoints when the application is in publish mode. Attackers who reach those endpoints can download the Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys. With this material the attacker can conduct unlimited offline master‑password cracking, because the system provides no rate‑limiting. The vulnerability is a classic example of improper protection of credentials, classified as CWE‑522.

SiYuan Note, all builds released before v3.7.4.

The calculated CVSS score of 8.7 indicates substantial impact. EPSS data is not available, so the likelihood of exploitation in the wild remains uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is remote exploitation of unauthenticated endpoints; an attacker simply accesses the publish‑mode APIs to retrieve the sensitive key materials.