CVE-2026-63405: AnyCable Authentication Bypass Vulnerability

CVE-2026-63405 Overview

CVE-2026-63405 is an authentication integrity flaw in AnyCable, a realtime server for two-way WebSocket communication. Versions prior to 1.6.15 fail to validate the digest of received request bodies in the Pusher-compatible REST API implemented in pusher/http.go. The server includes the caller-supplied body_md5 value in the HMAC input but never recomputes the digest against the actual body. An attacker holding a legitimate signed POST request can retain the query parameters and auth_signature, swap the body, and force Handler and handleEvents to broadcast attacker-selected events. The absence of an auth_timestamp freshness check allows indefinite replay of captured signatures.

Critical Impact
Attackers who capture one signed request can forge server-side events, mutate application state, and push arbitrary messages to WebSocket clients within the signed application context.

Affected Products

AnyCable realtime server versions prior to 1.6.15
Deployments exposing the Pusher-compatible REST API (pusher/http.go)
Applications relying on AnyCable HMAC-signed broadcast requests for integrity

Discovery Timeline

2026-09-18 - CVE-2026-63405 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63405

Vulnerability Analysis

The vulnerability is an Insufficient Verification of Data Authenticity issue [CWE-345] in the Pusher-compatible REST API. AnyCable computes its HMAC over a canonicalized string that includes the client-provided body_md5 query parameter. The server never validates that body_md5 matches an MD5 digest of the received request body. As a result, the HMAC only binds the metadata an attacker already controls, not the payload the server ultimately parses.

A second defect compounds the first. The REST handler does not verify the auth_timestamp value against a freshness window. Signed requests therefore remain valid indefinitely, permitting replay long after the original transaction.

Combined, an attacker who obtains a single legitimate signed POST request can craft new broadcasts within the signed application's context. Broadcasts flow through Handler and handleEvents and are delivered to every subscribed WebSocket client.

Root Cause

The root cause is trust in a caller-supplied integrity value. The server treats body_md5 as authoritative because it is covered by the HMAC, but it never independently derives the digest from the request body. Missing timestamp validation removes the temporal control that would otherwise limit signature reuse.

Attack Vector

Exploitation requires network access to the AnyCable REST endpoint and possession of one previously issued signed request. The attacker replays the query string and auth_signature while substituting an arbitrary JSON body. The server accepts the request and broadcasts the injected event content to WebSocket subscribers.

// Patch excerpt from pusher/http.go adding MD5 validation
import (
    "context"
    "crypto/md5" // #nosec G501
    "encoding/json"
    "fmt"
    "io"
)

Source: AnyCable commit d2cbadec792f038f4695c84a65c0d957b0fde72c

Detection Methods for CVE-2026-63405

Indicators of Compromise

Repeated POST requests to /apps/{app_id}/events sharing identical auth_signature and auth_timestamp values across distinct bodies.
Broadcast events whose payload content does not match legitimate application publisher activity.
Access log entries showing auth_timestamp values that are hours or days older than the request time.

Detection Strategies

Correlate signed REST API requests by (auth_key, auth_signature) tuple and alert when the same signature is observed more than once.
Compute MD5 of the request body at a reverse proxy and compare it to the body_md5 query parameter, flagging mismatches.
Baseline expected broadcast event names and channels, then alert on unexpected channels or event types delivered through the Pusher REST API.

Monitoring Recommendations

Ingest AnyCable and reverse proxy access logs into a centralized analytics platform and retain full request metadata.
Track the delta between server time and auth_timestamp on every request to surface stale or replayed signatures.
Monitor WebSocket broadcast fan-out volume for anomalous spikes tied to unusual REST clients or source IP ranges.

How to Mitigate CVE-2026-63405

Immediate Actions Required

Upgrade all AnyCable deployments to version 1.6.15 or later, which validates body_md5 and enforces auth_timestamp freshness.
Rotate Pusher-compatible API keys and secrets to invalidate any previously captured signed requests.
Audit broadcast history for unexpected events published since the vulnerable version was deployed.

Patch Information

The fix is delivered in AnyCable v1.6.15. The patch, detailed in GHSA-5p54-whvp-x327, computes an MD5 digest of the received body and compares it to the signed body_md5, and rejects requests whose auth_timestamp falls outside an acceptable window.

Workarounds

Terminate the REST API behind a reverse proxy that recomputes and enforces body_md5 before forwarding requests upstream.
Restrict network access to the Pusher-compatible REST endpoint to trusted publisher IP ranges only.
Enforce short-lived credentials and rotate HMAC secrets frequently until the patched version is deployed.

bash

# Example nginx guard: reject requests older than 300 seconds
# and require TLS-terminated access from trusted publishers
location /apps/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://anycable_upstream;
    proxy_set_header X-Forwarded-For $remote_addr;
}