Unrestricted API Token Brute Force in SiYuan Kernel

SiYuan kernel versions before 3.7.4 suffer from an improper restriction of excessive authentication attempts vulnerability (CWE-307) in the CheckAuth() middleware. The flaw allows unauthenticated remote attackers to bypass rate-limiting and CAPTCHA protections when attempting to guess API tokens submitted via Authorization headers or query parameters. This critical vulnerability (CVSS 9.8) affects any organization running vulnerable SiYuan instances, as attackers can conduct unlimited automated brute-force attacks against the API token without triggering account lockouts or challenge mechanisms. Once an attacker obtains a valid token, they gain full API access to the application, potentially enabling data exfiltration, system manipulation, or lateral movement within the infrastructure.

Casky's Claude-powered analysis engine would identify this attack pattern through behavioral anomaly detection across authentication logs, flagging high-volume failed authentication attempts from single or distributed sources targeting the token endpoint. Practitioners would observe findings related to Credential Access techniques—specifically Brute Force attacks—with extended reasoning revealing the absence of expected rate-limiting responses and CAPTCHA triggers despite repeated failed attempts. The platform would correlate suspicious query parameters (?token=) and Authorization headers with failed authentication sequences, allowing security teams to rapidly distinguish legitimate API usage from exploitation attempts and implement compensating controls or upgrade to patched versions before tokens are compromised.