EUVD-2026-83180
GHSA-5p54-whvp-x327
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
AC:H because the attacker must first capture a valid signed request; PR:N since no attacker credentials are needed; I:H for arbitrary event forgery, C:N/A:N as no disclosure or downtime results.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied body_md5 value in the HMAC input but does not calculate the digest of the received request body or compare it with the signed value. An attacker who obtains a legitimate signed POST request can retain its query parameters and auth_signature while replacing the body, causing Handler and handleEvents to accept and broadcast attacker-selected event content. The absence of an auth_timestamp freshness check also allows the captured signature to be replayed indefinitely. This can forge server-side events, modify application state, or deliver attacker-controlled messages to WebSocket clients within the signed request's application context. This issue is fixed in version 1.6.15.
AnalysisAI
Signed-request replay in AnyCable's Pusher-compatible REST API (version 1.6.14 and earlier) lets anyone who obtains a single legitimate signed POST request resend it with a completely different body, because the handler folds the caller-supplied body_md5 into the HMAC string but never computes or compares the digest of the body actually received. The same code path omits any auth_timestamp freshness check, so a captured auth_signature remains valid indefinitely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Pusher-compatible REST API in AnyCable (the pusher/http.go Handler/handleEvents path, endpoint /apps/<app_id>/events) to be enabled and reachable, on version <= 1.6.14. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine integrity flaw but a moderate-priority one, and the signals are internally consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: AnyCable 1.6.15, available from the release tag (https://github.com/anycable/anycable/releases/tag/v1.6.15) and the upstream commit d2cbadec792f038f4695c84a65c0d957b0fde72c; upgrading is the only complete fix because the patch both recomputes MD5 over the request body before handling events and rejects requests whose auth_timestamp is more than 600 seconds from server time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Share
External POC / Exploit Code
Leaving vuln.today