CVE-2026-116825: Services Httpsignatureservice Php Cwe 918 Cve 2026 116825
This function verifies an inbound HTTP request signature with openssl_verify() but accepts the request without any anti-replay control: the signed Date header is never checked against the server clock and accepted signatures are never recorded. A captured, validly signed request (for example an ActivityPub inbox POST performing Delete, Update, Follow or Undo
PHPgreprules fetch cve-2026-116825-services-httpsignatureservice-php-cwe-918-cve-2026-116825 --engine opengrepDescription
This function verifies an inbound HTTP request signature with openssl_verify() but accepts the request without any anti-replay control: the signed Date header is never checked against the server clock and accepted signatures are never recorded. A captured, validly signed request (for example an ActivityPub inbox POST performing Delete, Update, Follow or Undo
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.