An unauthenticated signature bypass vulnerability in YesWiki versions 4.6.2 through 4.6.5 poses a high risk of unauthorized activity processing.

The application incorrectly handles the return values of PHP's openssl_verify function within the HttpSignatureService class. Because the code fails to account for the -1 return value, an attacker can cause the application to treat an invalid cryptographic signature as valid, allowing the processing of arbitrary payloads without authentication.

This vulnerability allows unauthenticated remote attackers to bypass critical security checks, potentially leading to unauthorized data modification or system disruption. With a CVSS score of 8.2, the flaw is classified as High severity, as it directly impacts the integrity of the wiki system. Failure to remediate this issue could result in the compromise of wiki content and administrative control over the affected instance.

Immediate Action: Update the YesWiki installation to version 4.6.6 or later to implement the corrected signature verification logic.

Proactive Monitoring: Review web server and application access logs for unusual activity or requests directed at the activity processing endpoints that lack valid signatures.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the wiki system to known, trusted IP addresses until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

The vulnerability in YesWiki represents a significant risk to system integrity due to the ease of bypassing cryptographic verification. Organizations should prioritize updating to version 4.6.6 immediately to eliminate the possibility of unauthorized payload processing. Given the high CVSS score and the nature of the flaw, prompt remediation is essential to maintain a secure environment.