CVE-2026-116825

🎯 CVE-2026-116825 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-116825 | YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

Klassifikation & Betroffenheit:

CWE-294 YesWiki yeswiki 4.6.2 <4.7.0

Authentication Bypass by Capture-replay 🎯 High

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

🛡️ Empfohlene Mitigation: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-60 · Reusing Session IDs (aka Session Replay) (High) CAPEC-102 · Session Sidejacking (High) CAPEC-509 · Kerberoasting (High) CAPEC-555 · Remote Services with Stolen Credentials (Very High) CAPEC-561 · Windows Admin Shares with Stolen Credent… CAPEC-644 · Use of Captured Hashes (Pass The Hash) (High) CAPEC-645 · Use of Captured Tickets (Pass The Ticket… (High) CAPEC-652 · Use of Known Kerberos Credentials (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1134.001 · Access Token Manipulation:Token Im… T1550.004 · Use Alternate Authentication Mater… T1558.003 · Steal or Forge Kerberos Tickets:Ke… T1021 · Remote Services T1114.002 · Email Collection:Remote Email Coll… T1133 · External Remote Services

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-46670 9.8 CVE-2026-52778 9.8 CVE-2025-67135 9.8 CVE-2025-65552 9.8 CVE-2024-38438 9.8

🩹 Patch verfügbar (OSV):

🩹 bba4abccdf68476dde3d7119019139121849fb32 (Commit)

📰 Eigene Berichterstattung: ➔ CVE-2026-116825 | YesWiki up to 4.6.2 HttpSignatureService verifySignature authe

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 28.10.

CVSS-Vektor-Analyse: 8.3

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA…

Veröffentlicht:27.10.2026

Aktualisiert:27.10.2026 00:17

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-110532

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-294 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	737	0,2 %
≥50 %	3.221	0,8 %
≥10 %	22.076	5,8 %
<10 %	354.695	93,2 %

8.3 HIGH

EPSS

CVE-2026-116825 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

YesWiki

CVE-2026-116825 | YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

CWE-294 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 1 Tag

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub