CVE-2026-63405

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15

Description The Pusher-compatible REST API in pusher/http.go includes the caller-supplied body md5 value in the HMAC input but fails to calculate the digest of the received request body or compare it with the signed value. This allows an attacker who obtains a legitimate signed POST request to retain the query parameters and auth signature while replacing the request body. Consequently, the Handler() and handleEvents() functions may accept and broadcast attacker-selected event content. Additionally, the lack of an auth timestamp freshness check allows captured signatures to be replayed indefinitely. This can lead to the forging of server-side events, modification of application state, or delivery of attacker-controlled messages to WebSocket clients within the signed request's application context.

Recommendations Update AnyCable to version 1.6.15.