CVE-2026-116825 Details
Description
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
A vulnerability exists in YesWiki versions 4.6.2 prior to 4.7.0, where the HttpSignatureService::verifySignature() function lacks proper replay protection. The function fails to validate the Date header or track previously seen signatures, allowing attackers to capture and later replay signed requests to the /api/forms/{formId}/actor/inbox endpoint. This replay can be used to re-execute Delete, Update, Follow, or Undo actions on behalf of the original signer.
Users are advised to update to YesWiki version 4.7.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7m9j-h553-397x | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7m9j-h553-397x | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-from-4.6.2-before-4.7.0-http-signature-replay-via-activitypub-inbox | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | >= 4.6.2, < 4.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |