CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
Attackers can replay signed requests with modified bodies to forge events and deliver malicious messages due to missing MD5 verification and timestamp checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63405?
CVE-2026-63405 is a medium-severity vulnerability in anycable, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.
Weakness: CWE-345
Which versions are affected by CVE-2026-63405?
3 open source packages ship an affected version, including github.com/anycable/anycable and github.com/anycable/anycable-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/anycable/anycable Go | All versions | 1.6.15 |
github.com/anycable/anycable Go | All versions | 1.6.15 |
github.com/anycable/anycable-go Go | All versions | None |
How do I fix CVE-2026-63405?
Upgrade github.com/anycable/anycable to 1.6.15 or later.
Is CVE-2026-63405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63405 exists.
Sources
Also known as GHSA-5p54-whvp-x327, GO-2026-6516.