SiYuan before version 3.7.4 contains a flaw in the authentication middleware that allows an attacker to send unlimited Basic Authentication attempts without encountering any lockout or CAPTCHA protection. The workspace access code is accepted as the password for the HTTP Basic Auth branch guarding the entire /api/ surface, but the failure counter and lockout gate are never consulted. Attackers can therefore brute‑force the admin access code, gain administrative privileges, and fully control the kernel. A secondary weakness is that the access code comparison uses a non‑constant‑time string comparison, potentially enabling timing attacks.

Any installation of SiYuan note running a version before 3.7.4 is affected. This includes all releases up to and including 3.7.3, which lack the authentication counter, CAPTCHA gate, and constant‑time comparison introduced in 3.7.4.

The CVSS score of 9.3 indicates critical severity. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, there is no publicly reported exploitation data; however, the vulnerability is easily exploitable over the network using automated scripts that target the /api/* endpoints with HTTP Basic Auth. Attackers require only network access to the API service and can instantly achieve full administrative control without the need for privileged local access.