Authorization Bypass in Chatify Product by Munafio

CVE-2026-120425

What is CVE-2026-120425?

An authorization bypass vulnerability in Chatify prior to version 1.6.4 allows authenticated users to access other users' private channels. By exploiting the Pusher channel authorization endpoint, attackers can craft requests to subscribe to arbitrary channel names. This enables them to receive a victim's private messages and attachments in real-time through unauthorized access, highlighting the need for immediate updates and security measures to safeguard user data.

References