CVE-2026-52767: YesWiki Authentication Bypass Vulnerability

CVE-2026-52767 Overview

CVE-2026-52767 is a signature verification bypass in YesWiki, a PHP-based wiki system. The vulnerability affects versions 4.6.2 through versions before 4.6.6. The flaw resides in HttpSignatureService::verifySignature(), which incorrectly evaluates the return value of PHP's openssl_verify() function. A crafted request that causes OpenSSL to return -1 bypasses signature validation because PHP treats -1 as a truthy value. The controller then processes the attacker's payload as if the signature had verified successfully. The issue is classified under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Attackers can bypass HTTP signature verification and submit forged ActivityPub payloads that the controller processes as authenticated.

Affected Products

YesWiki versions 4.6.2 through 4.6.5
YesWiki bazar component (tools/bazar/services/HttpSignatureService.php)
Patched in YesWiki 4.6.6

Discovery Timeline

2026-09-05 - CVE-2026-52767 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52767

Vulnerability Analysis

The vulnerability affects the HTTP signature verification path used by YesWiki's bazar federation controller. The verifySignature() method delegates cryptographic verification to PHP's openssl_verify() and checks the outcome using a loose boolean negation. openssl_verify() can return 1 for success, 0 for a signature mismatch, or -1 for an internal OpenSSL error. Because PHP evaluates -1 as truthy, the negated check !openssl_verify(...) returns false when -1 is returned. The exception path is skipped, and control flow reaches processActivity() with attacker-supplied data. Any condition that forces EVP_VerifyFinal() to fail internally, such as a malformed public key or an unsupported algorithm, triggers the bypass.

Root Cause

The root cause is a misuse of a ternary-return API. Cryptographic functions that return integer status codes require strict equality checks against the success value. Loose boolean coercion collapses the distinct 0 and -1 states, treating verification errors as verification successes.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a signed HTTP request to a YesWiki endpoint that routes through HttpSignatureService::verifySignature(). By supplying inputs that cause OpenSSL's internal verification routine to return -1, the attacker bypasses the signature check and delivers a forged ActivityPub activity to processActivity().

php

// Patch: tools/bazar/services/HttpSignatureService.php
-        if (!openssl_verify(join("\n", $sigParts), base64_decode($sigConf['signature']), $actorPublicKey, strtoupper($sigConf['algorithm']))) {
+        if (openssl_verify(join("\n", $sigParts), base64_decode($sigConf['signature']), $actorPublicKey, strtoupper($sigConf['algorithm'])) !== 1) {
             throw new Exception('Signature verification failed');
         }

Source: GitHub Commit d1795e0. The patch replaces the loose negation with a strict !== 1 comparison, ensuring that only the explicit success value permits control flow to continue.

Detection Methods for CVE-2026-52767

Indicators of Compromise

Inbound HTTP requests to YesWiki bazar federation endpoints containing malformed Signature headers or unusual algorithm values that would cause OpenSSL errors.
Unexpected processActivity() invocations tied to actors whose public keys fail to parse or use unsupported algorithms.
YesWiki application logs showing accepted federated activities without a corresponding successful signature validation entry.

Detection Strategies

Inspect web server logs for POST requests targeting YesWiki bazar routes with unusual Signature header structures.
Correlate ActivityPub content changes with the source IP and actor to identify federation writes that lack legitimate signature provenance.
Deploy a WAF rule that blocks requests where the Signature header references algorithms not in an allowlist (e.g., only RSA-SHA256).

Monitoring Recommendations

Alert on any YesWiki instance running versions between 4.6.2 and 4.6.5 inclusive.
Monitor PHP error logs for OpenSSL warnings originating from HttpSignatureService.php.
Track anomalous outbound federation traffic that follows suspicious inbound signed requests.

How to Mitigate CVE-2026-52767

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later without delay.
Audit federation logs for any processActivity() calls that may have processed forged payloads while running vulnerable versions.
Rotate any credentials or tokens that may have been exposed to a compromised YesWiki instance.

Patch Information

The fix is available in YesWiki 4.6.6. See the GitHub Release v4.6.6 and the GitHub Security Advisory GHSA-mv28-wj57-f57g. The patch changes the signature check in HttpSignatureService::verifySignature() from a loose negation to a strict !== 1 comparison against the return value of openssl_verify().

Workarounds

Disable the bazar federation functionality if the upgrade cannot be applied immediately.
Place the YesWiki instance behind a reverse proxy that filters inbound signed federation requests to trusted peers only.
Restrict inbound traffic to the affected endpoints via network ACLs until patching is complete.

bash

# Verify installed YesWiki version and upgrade
grep -R "YESWIKI_VERSION" /var/www/yeswiki/includes/constants.php
cd /var/www/yeswiki && git fetch --tags && git checkout v4.6.6