---
id: CVE-2026-63405
title: >-
  AnyCable is a realtime server for reliable two-way communication that supports
  any backend
summary: >-
  AnyCable is a realtime server for reliable two-way communication that supports
  any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go
  includes the caller-supplied body_md5 value in the HMAC input but does not
  calc…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-345
vendor: anycable
product: github.com/anycable/anycable
affected:
  - github.com/anycable/anycable <= 1.6.14
patched:
  - github.com/anycable/anycable 1.6.15
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:10.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63405'
references:
  - url: >-
      https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c
    label: security-advisories@github.com
  - url: 'https://github.com/anycable/anycable/releases/tag/v1.6.15'
    label: security-advisories@github.com
  - url: >-
      https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327
    label: security-advisories@github.com
  - url: >-
      https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-5p54-whvp-x327'
  - url: 'https://github.com/anycable/anycable'
tags:
  - nvd
  - ghsa
  - go
  - cve.org
  - exploit-available
  - osv
aliases:
  - GHSA-5p54-whvp-x327
ecosystem: go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:07:09.768503Z'
ingestedAt: '2026-09-18T17:46:41.522Z'
epss: 0.00172
epssPercentile: 0.06868
---

## Overview

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63405)

Affected packages:

- `github.com/anycable/anycable <= 1.6.14`

Patched in:

- `github.com/anycable/anycable 1.6.15`

Source: https://github.com/advisories/GHSA-5p54-whvp-x327