The vulnerability exists in YesWiki's tools/bazar/services/HttpSignatureService.php within the verifySignature() method, which is called by the /api/forms/{formId}/actor/inbox route. The method parses the HTTP Signature header and immediately issues an HTTP GET request to the keyId URL before performing any signature verification or validation. Because the route is publicly accessible and the attacker controls the keyId URL, this leads to an unauthenticated SSRF allowing arbitrary outbound HTTP requests. The server's response may leak exception details including the requested URL, enabling information disclosure. The vulnerability requires ActivityPub to be enabled on the targeted form and affects versions >=4.6.2 and <4.6.6.

An unauthenticated remote attacker can exploit this SSRF to make the YesWiki server perform arbitrary HTTP GET requests to internal or external hosts accessible from the server. This can be used to scan internal networks, access cloud metadata endpoints (e.g., AWS IAM credentials), and enumerate services. Additionally, error responses may leak sensitive information such as exception messages and stack traces, further aiding an attacker in reconnaissance or exploitation. The vulnerability compromises confidentiality, integrity, and availability as indicated by the CVSS vector.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable ActivityPub on all forms if not required, or restrict access to the vulnerable endpoint via network controls. Avoid exposing the /api/forms/{formId}/actor/inbox route publicly if possible. Monitor vendor communications for updates and apply official patches once released.