CVE-2026-63405: Insufficient Verification of Data Authenticity in AnyCable Pusher REST API

Vulnerability ID: CVE-2026-63405
CVSS Score: 5.9
Published: 2026-09-18

AnyCable is a real-time communication server. Prior to version 1.6.15, its Pusher-compatible REST API suffered from an authentication bypass vulnerability because it failed to verify that the request body matched the signature-validated body_md5 parameter. This allows attackers to perform replay attacks with modified body contents.

TL;DR

AnyCable's Pusher-compatible REST API failed to validate that the HTTP POST request body matched the signature-verified body_md5 parameter, enabling arbitrary message injection via request replays.

Technical Details

• CWE ID: CWE-345 / CWE-294
• Attack Vector: Network
• CVSS v3.1 Score: 5.9 (Medium)
• Exploit Status: None (No public exploit available)
• EPSS Score: 0.00172 (0.17%)
• CISA KEV Status: Not Listed

Affected Systems

• AnyCable Go Server (anycable-go)
• anycable-go: < 1.6.15 (Fixed in: 1.6.15)

Code Analysis

Commit: d2cbade

Implement MD5 calculation and timestamp validation for the Pusher-compatible REST API

Mitigation Strategies

• Upgrade AnyCable to version 1.6.15 or later
• Enforce maximum request body size limits at the reverse proxy layer to prevent potential denial of service via memory exhaustion during MD5 calculations
• Restrict access to Pusher-compatible API endpoints using network firewalls or security groups

Remediation Steps:

1. Update the anycable-go dependency to v1.6.15 in your go.mod file using 'go get github.com/anycable/[email protected]'
2. Rebuild and redeploy the AnyCable server binary to production
3. Configure your reverse proxy (e.g., Nginx client_max_body_size) to limit maximum request sizes on the Pusher API path

References

• GitHub Security Advisory GHSA-5p54-whvp-x327
• Fix Commit d2cbadec792f038f4695c84a65c0d957b0fde72c
• AnyCable v1.6.15 Release Notes
• NVD - CVE-2026-63405

Read the full report for CVE-2026-63405 on our website for more details including interactive diagrams and full exploit analysis.