Credential-Brute-Force - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/credential-brute-force/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 16 Aug 2026 14:25:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBrute-Force Vulnerability in SiYuan Kernel API Authenticationhttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/Sun, 16 Aug 2026 14:25:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/SiYuan kernel versions prior to 3.7.4 contain a flaw in the CheckAuth() middleware that permits unlimited authentication attempts against API tokens, enabling attackers to gain administrative access.SiYuan kernel versions before 3.7.4 are susceptible to an authentication bypass vulnerability within the CheckAuth() middleware. The vulnerability arises because the middleware, which processes authentication for the API, fails to integrate with the application's global protection mechanisms such as CAPTCHA challenges or account lockout policies (NeedCaptcha/WrongAuthCount). This oversight allows an unauthenticated remote attacker to perform rapid, automated brute-force guessing of the API token (Conf.Api.Token) via either an Authorization header or a URL query parameter.

Successful exploitation grants the attacker RoleAdministrator privileges, which provides full control over the application, including the ability to execute arbitrary SQL queries and perform file system operations. This is particularly critical in environments where administrators have configured weak or short custom tokens. Organizations using SiYuan must prioritize updating to version 3.7.4 or higher to enforce proper authentication throttling.

Impact

Successful exploitation results in full administrative takeover of the SiYuan application instance. This allows attackers to perform unauthorized data exfiltration via SQL queries, modify or delete sensitive data, and manipulate the underlying server file system, potentially leading to persistent backdoors or full system compromise.

Recommendation

  • Upgrade all SiYuan kernel instances to version 3.7.4 or later immediately.
  • Audit current API token configurations to ensure they meet strong entropy requirements if immediate patching is not possible.
  • Monitor web application logs for high-frequency POST or GET requests to the SiYuan API endpoints containing token-related parameters or headers originating from a single IP address.
]]>criticaladvisoryauthentication-bypasscredential-brute-forceweb-application