Vulnerability in AnyCable Pusher-Compatible REST API Affects Communication Security

CVE-2026-63405

What is CVE-2026-63405?

Prior to version 1.6.15, the Pusher-compatible REST API in AnyCable did not properly validate the MD5 digest of the request body against the signed value. This allowed an attacker to capture a legitimate signed POST request, modify the body content, and replace event data, which could lead to unauthorized server-side events and altered application states. Additionally, the lack of a freshness check for the auth_timestamp permitted replay attacks, allowing attackers to continuously exploit the captured signature. This vulnerability could enable attackers to send manipulated messages to WebSocket clients, ultimately compromising the security of the communication channel.

References