YesWiki is a PHP‑based wiki system vulnerable to a signature‑verification bypass in versions 4.6.2 to 4.6.5. The HttpSignatureService::verifySignature() method checks the result of PHP's openssl_verify() with a loose negation, treating a return value of –1 as a successful verification. Because –1 is truthy, the exception is skipped and the request proceeds to processActivity(), allowing an attacker to supply a forged ActivityPub payload that the system will accept and execute. The flaw effectively gives an unauthenticated attacker remote code execution capability.

Vendors affected are YesWiki maintained at YesWiki:yeswiki. All releases starting with 4.6.2 up to, but not including, 4.6.6 are vulnerable. Users running any of those versions should consider the issue critical until addressed.

With a CVSS score of 8.2, the vulnerability is classified as high severity. No EPSS score is currently available, and it is not listed in the CISA KEV catalog. The attack does not require authentication; any external entity able to send ActivityPub requests can trigger the bypass if the underlying OpenSSL EVP_VerifyFinal call returns –1, a condition that can be triggered by malformed or intentional cryptographic failures. Successful exploitation results in the server ingesting the payload and performing unauthorized actions, potentially leading to full system compromise.