Read the docs
TI-2026-45192 Aliases CVE-2026-63405GHSA-5p54-whvp-x327

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

Priority MEDIUM 60CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix Fixed anycable (anycable): 1.6.15github.com/anycable/anycable (Go): 1.6.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anycableanycablebefore 1.6.151.6.15Patch availableCNA
—github.com/anycable/anycable (Go)before 1.6.151.6.15Patch availableGHSA-5p54-whvp-x327
  • anycable Vendoranycable Affected before 1.6.15 Fixed in 1.6.15 Patch available CNA
  • github.com/anycable/anycable (Go) Vendor— Affected before 1.6.15 Fixed in 1.6.15 Patch available GHSA-5p54-whvp-x327

Remediation

  • Fix · CNA anycable (anycable) Fixed in 1.6.15
  • Fix · GHSA-5p54-whvp-x327 github.com/anycable/anycable (Go) Fixed in 1.6.15 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63405
  2. 2026-10-03 Alias added: GHSA-5p54-whvp-x327
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-45193 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences