CVE-2026-63405
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
AnyCable before version 1.6.15 has a vulnerability in the Pusher-compatible REST API where the body_md5 value is included in HMAC but not verified against the actual request body. An attacker with a valid signed POST request can replace the body, and the lack of auth_timestamp freshness check allows replay attacks. This can lead to forged server events, state modification, or delivering attacker-controlled messages to WebSocket clients. Fixed in version 1.6.15.
Risk Assessment
An attacker can forge events and modify application state, potentially leading to data integrity breaches and loss of user trust.
Recommendation
Update AnyCable to version 1.6.15 or later. Additionally, consider implementing timestamp freshness checks and body_md5 validation.
Other vulnerabilities in AnyCable
Original NVD description (English source)
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS