YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.

YesWiki versions 4.6.2 through 4.6.5 contain a critical signature verification bypass in HttpSignatureService::verifySignature(). The flaw arises from improper handling of PHP's openssl_verify() return values using a loose boolean negation. PHP's openssl_verify() can return -1 on error, which is truthy, causing the negation to evaluate as false and skipping the exception throw. This allows an attacker to bypass HTTP signature verification entirely, as the controller proceeds to processActivity() treating the failed verification as success. The root cause is the failure to distinguish between a failed verification (0), an error (-1), and a success (1). Any condition triggering OpenSSL's EVP_VerifyFinal() to return -1 can be weaponized. The issue has been patched in YesWiki version 4.6.6 with a stricter equality check.