{"id":"EUVD-2026-83180","enisaUuid":"3f5d1a51-3fc1-379b-a977-099ea44b7426","description":"AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request\u0027s application context. This issue is fixed in version 1.6.15.","datePublished":"Sep 18, 2026, 4:47:37 PM","dateUpdated":"Sep 18, 2026, 5:07:38 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327\nhttps://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c\nhttps://github.com/anycable/anycable/releases/tag/v1.6.15\n","aliases":"CVE-2026-63405\nGHSA-5p54-whvp-x327\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"0a8ad96a-735e-3050-b06d-2da3064df1b0","product":{"name":"anycable","vendor":{"name":"anycable"}},"product_version":"\u003c 1.6.15"}],"enisaIdVendor":[{"id":"615d3e48-7dbf-3156-94e9-13758e896ff9","vendor":{"name":"anycable"}}],"enisaIdVulnerability":[{"id":"28c41d4c-1b5a-31bd-bbe3-2e6e92227431","vulnerability":{"id":"CVE-2026-63405","description":"AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request\u0027s application context. This issue is fixed in version 1.6.15.","datePublished":"Sep 18, 2026, 4:47:37 PM","dateUpdated":"Sep 18, 2026, 5:07:38 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327\nhttps://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c\nhttps://github.com/anycable/anycable/releases/tag/v1.6.15\n","enisa_id":"EUVD-2026-83180\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:15:58 AM","vulnerabilityProduct":[{"id":"02595e9d-6d0a-3a54-9854-d8bca25114f6","product":{"name":"anycable","vendor":{"name":"anycable"}},"product_version":"\u003c 1.6.15"}],"vulnerabilityVendor":[{"id":"b96b0d85-f396-35f2-985a-e5b80ddae338","vendor":{"name":"anycable"}}]}},{"id":"89c31517-4305-3cea-8741-aca7f22f68f4","vulnerability":{"id":"GHSA-5p54-whvp-x327","description":"AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body","datePublished":"Sep 18, 2026, 5:16:25 PM","dateUpdated":"Sep 18, 2026, 5:16:25 PM","baseScore":0.0,"references":"https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327\nhttps://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c\nhttps://github.com/anycable/anycable\nhttps://github.com/anycable/anycable/releases/tag/v1.6.15\n","enisa_id":"EUVD-2026-83180\n","aliases":"CVE-2026-63405\nGHSA-5p54-whvp-x327\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}