SiYuan Kernel: Unauthenticated event stream access via URI parser differential (CVE-2026-73054)

The SiYuan kernel suffers from a parser differential vulnerability where the logic used to exempt WebSocket keepalive sessions from authentication matches raw substrings, while the logic used to quarantine those sessions parses the query string. By sending a crafted URI containing duplicated 'id' and 'type' keys, an attacker can satisfy the authentication exemption while tricking the quarantine logic, leading to the session being placed in the active broadcast pool rather than a quarantined state. This issue, tracked as CVE-2026-73054, allows unauthenticated remote callers to receive live event streams on instances configured with an access auth code.

Impact

Successful exploitation allows unauthenticated remote attackers to gain visibility into system metadata. Observed disclosed information includes document identifiers, document titles, notebook names, file paths, notebook child structures, and a real-time stream of create, update, and delete operations. Document body content is not currently confirmed to be exposed via this vector. The vulnerability also lacks origin validation, maintaining susceptibility to cross-origin attacks.

Recommendation

• Upgrade the SiYuan kernel to version 0.0.0-20260731131820-67bc300b6ea6 or later immediately.
• Implement request-level monitoring on the /ws WebSocket endpoint to identify and block requests containing duplicate query parameters.
• Audit logs for WebSocket connections that establish session IDs associated with the broadcast pool while lacking valid session authentication tokens.