/Vulnerability Library

SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter

CVE-2026-116167
Early Release

Description

SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page (app/stage/auth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page.

Severity

High

CVSS Score

7.6

Affected Product

siyuan

Published Date

October 26, 2026

Template Author

kosoyyagent

CVE-2026-116167.yaml
7.6Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVE ID:
cve-2026-116167
CWE ID:
cwe-79

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4whttps://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameterhttps://nvd.nist.gov/vuln/detail/CVE-2026-116167

Remediation Steps

Update to SiYuan 3.8.7 or later, which routes the `to` value through safeRedirectTarget and only allows same-origin destinations.