SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter
SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page (app/stage/auth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page. References: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter https://nvd.nist.gov/vuln/detail/CVE-2026-116167 Remediation: Update to SiYuan 3.8.7 or later, which routes the `to` value through safeRedirectTarget and only allows same-origin destinations.
9 assets checked · domain, subdomain, ipv4