Executive brief
AnyCable's Pusher-compatible API signs requests using a security token but never verifies the actual body content matches what was signed, allowing attackers to intercept and replay legitimate requests with completely different payloads. An attacker who observes even one signed API call can craft unlimited forged events to broadcast to any channel, potentially injecting malicious data to all connected WebSocket clients.
Technical details
The vulnerability is a signature validation bypass in the Pusher protocol implementation. The handler extracts and verifies an HMAC signature over a string that includes a `body_md5` parameter, but never actually computes or validates the MD5 hash of the HTTP request body against the signed digest. This allows an attacker to capture a legitimate signed request, change the body content arbitrarily while keeping the same HMAC-signed query parameters, and the server will accept it. Additionally, there is no timestamp staleness check, enabling indefinite replay of captured requests. The fix requires computing `md5(body)` after reading the request body, constant-time comparison against the signed `body_md5` parameter, and rejection of requests with stale `auth_timestamp` values.
Affected products
- AnyCable AnyCable <UNKNOWN>
Timeline
- 2026-09-18: disclosed
- other: CVE-2026-63405 assigned