# CVE-2026-63405: AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

> CVE-2026-63405 (GitHub advisory GHSA-5p54-whvp-x327) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Insufficient Verification of Data Authenticity (CWE-345), in github.com/anycable/anycable (Go). Affected versions: <= 1.6.14. It is fixed in 1.6.15.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-63405

| Field | Value |
| --- | --- |
| CVE | CVE-2026-63405 |
| GHSA | GHSA-5p54-whvp-x327 |
| Severity | Medium |
| CVSS 3.1 | 5.9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-345 Insufficient Verification of Data Authenticity |
| EPSS | 0.17% (higher than 6% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable no, technical impact partial |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

The Pusher-compatible REST API includes `body_md5` in the HMAC signature string but never computes or verifies the MD5 of the received HTTP body, allowing anyone who observes a signed request to replay it with an entirely different body.

##### Details
In `pusher/http.go`, the `Handler` function extracts `body_md5` from the URL query string (line 169) and includes it verbatim in `stringToSign` (line 175). It then verifies `HMAC(stringToSign, secret) == auth_signature`. After verification succeeds, `handleEvents` reads and parses `r.Body` (lines 201-212) without ever computing `md5(body)` and comparing it against the `body_md5` that was signed. The Pusher protocol specification explicitly requires the server to verify this digest to prevent body-substitution attacks. There is also no `auth_timestamp` staleness check, so replays are valid indefinitely.

##### PoC
1. Capture a legitimate signed POST to `/apps/<app_id>/events?auth_key=K&auth_timestamp=T&auth_version=1.0&body_md5=LEGIT_MD5&auth_signature=SIG` carrying body `{"name":"safe-event","channel":"ch","data":"..."}` (e.g., from TLS-terminating load-balancer logs).
2. Send a new request with the same query string parameters but a different body:
   `{"name":"injected-event","channel":"admin","data":"malicious-payload"}`
3. The server accepts the request (HMAC over `stringToSign` matches the original) and broadcasts the injected event to all subscribers of `admin`.

##### Impact
An attacker who can read any single signed Pusher API request (from logs, a shared proxy, or a network tap) can broadcast arbitrary events to any channel indefinitely, potentially forging server-side events, corrupting application state, or delivering phishing messages to WebSocket clients.

##### Fix
After reading `r.Body`, compute `hex(md5(body))` and compare it to the `body_md5` query parameter using a constant-time comparison before proceeding. Additionally, reject requests whose `auth_timestamp` is more than 600 seconds from the current time.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| github.com/anycable/anycable | Go | `pkg:golang/github.com/anycable/anycable` | <= 1.6.14 | 1.6.15 |

## Fix commits

- Patch: https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c
- Release: https://github.com/anycable/anycable/commit/6e7591c009e53186b64ab013d10ab26aac9e7899 (1.6.15)

## Questions

**What is the GHSA ID for CVE-2026-63405?**

GitHub tracks CVE-2026-63405 as GHSA-5p54-whvp-x327.

**What is the CVSS score of CVE-2026-63405?**

CVE-2026-63405 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.

**Which versions are affected by CVE-2026-63405?**

github.com/anycable/anycable (Go): <= 1.6.14.

**How do I fix CVE-2026-63405?**

Upgrade to 1.6.15 or later. The fix is in commit d2cbade.

**What is the Package URL (PURL) for CVE-2026-63405?**

The affected package's PURL is pkg:golang/github.com/anycable/anycable.

**Is CVE-2026-63405 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-63405. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6% of CVEs.

## References

- https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c (fix)
- https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63405.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-63405 (advisory)
- https://github.com/advisories/GHSA-5p54-whvp-x327 (advisory)
- https://github.com/anycable/anycable (package)
- https://github.com/anycable/anycable/releases/tag/v1.6.15

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-63405), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.