Chatify versions prior to 1.6.4 allow an authenticated user to request a channel signature for any private channel by supplying an arbitrary channel name. This bypasses Pusher’s authorization checks and enables the attacker to subscribe to another user’s private channel, thus gaining real‑time access to that user’s private messages and attachments. The vulnerability compromises the confidentiality of individual users’ communications and may expose sensitive attachments.

The affected product is munafio’s Chatify web messaging platform. Versions older than 1.6.4, including 1.6.3 and earlier releases, are vulnerable. All deployments running a pre‑1.6.4 Chatify release should be considered at risk.

The CVSS score of 7.1 indicates a medium‑to‑high severity. No EPSS score is published, and the vulnerability is not listed in CISA KEV, suggesting a lower current exploitation likelihood but still providing a viable attack vector. The attack requires the attacker to be a logged‑in user and to craft a POST request to /chat/auth with a fabricated channel name. After obtaining the signature from Chatify, the attacker can connect to Pusher as that user’s private channel and intercept messages in real time.