CVE-2026-63405

Overview

AnyCable prior to version 1.6.15 contains an insufficient HMAC validation flaw in its Pusher-compatible REST API. Specifically, it fails to compute and verify the body digest and lacks a timestamp freshness check. This matters because it allows captured requests to be replayed and modified to forge server-side events.

Description

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.

Impact

This vulnerability impacts integrity by allowing unauthorized modification of application state and the forgery of server-side events sent to WebSocket clients. Confidentiality and availability impacts are limited, but authenticated sessions and application logic within the affected scope are at risk from replay and content-substitution attacks. Organizations using the Pusher-compatible HTTP API are directly impacted.

Remediation

Upgrade AnyCable to version 1.6.15 or later immediately. Ensure that all dependencies utilizing the Pusher-compatible REST API are updated and monitor API logs for unusual request patterns or replay indicators.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 5.9. EPSS data is currently unavailable. Urgency is moderate, depending on exposure of the Pusher-compatible REST API to untrusted networks.

Affected products

• AnyCable < 1.6.15