CVE-2026-104458 — YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64,…
Published: 2026-10-02 · CVSS: 8.3 · CVSS 4.0
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7