CVE-2026-63405Medium· 5.9▾ TwilightPoC availableAnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calc…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/anycable/anycable <= 1.6.14Patched in:
github.com/anycable/anycable 1.6.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63406Medium· 5.9AnyCable is a realtime server for reliable two-way communication that supports any backend
CVE-2026-63127High· 8.2RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-32597High· 7.5PyJWT is a JSON Web Token implementation in Python
CVE-2026-54608High· 7.1MythicalDash is a Pterodactyl client area
CVE-2026-86038High· 7.5libp2p is a JavaScript implementation of the libp2p networking stack
CVE-2026-86039High· 8.2libp2p is a JavaScript implementation of the libp2p networking stack