CVE-2026-116825

The YesWiki software (versions 4.6.2 before 4.7.0 ) is vulnerable to an HTTP Signature Replay attack via the ActivityPub Inbox. The root cause is located in HttpSignatureService::verifySignature(), which fails to validate the Date header or track previously seen signatures. An attacker who captur...