{"uuid": "e6e10952-a86b-4d4a-9443-34a3f838d27e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63405", "type": "seen", "source": "https://gist.github.com/alon710/5e8f8e10b5d10b651ea44234a36a9e37", "content": "# CVE-2026-63405: CVE-2026-63405: Insufficient Verification of Data Authenticity in AnyCable Pusher REST API\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63405\n\n## Summary\nAnyCable is a real-time communication server. Prior to version 1.6.15, its Pusher-compatible REST API suffered from an authentication bypass vulnerability because it failed to verify that the request body matched the signature-validated body_md5 parameter. This allows attackers to perform replay attacks with modified body contents.\n\n## TL;DR\nAnyCable's Pusher-compatible REST API failed to validate that the HTTP POST request body matched the signature-verified body_md5 parameter, enabling arbitrary message injection via request replays.\n\n## Technical Details\n\n- **CWE ID**: CWE-345 / CWE-294\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **Exploit Status**: None (No public exploit available)\n- **EPSS Score**: 0.00172 (0.17%)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- AnyCable Go Server (anycable-go)\n- **anycable-go**: < 1.6.15 (Fixed in: `1.6.15`)\n\n## Mitigation\n\n- Upgrade AnyCable to version 1.6.15 or later\n- Enforce maximum request body size limits at the reverse proxy layer to prevent potential denial of service via memory exhaustion during MD5 calculations\n- Restrict access to Pusher-compatible API endpoints using network firewalls or security groups\n\n**Remediation Steps:**\n1. Update the anycable-go dependency to v1.6.15 in your go.mod file using 'go get github.com/anycable/anycable-go@v1.6.15'\n2. Rebuild and redeploy the AnyCable server binary to production\n3. Configure your reverse proxy (e.g., Nginx client_max_body_size) to limit maximum request sizes on the Pusher API path\n\n## References\n\n- [GitHub Security Advisory GHSA-5p54-whvp-x327](https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327)\n- [Fix Commit d2cbadec792f038f4695c84a65c0d957b0fde72c](https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c)\n- [AnyCable v1.6.15 Release Notes](https://github.com/anycable/anycable/releases/tag/v1.6.15)\n- [NVD - CVE-2026-63405](https://nvd.nist.gov/vuln/detail/CVE-2026-63405)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63405) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T15:31:24.021861Z"}