AnyCable’s Pusher‑compatible REST API ignores the body_md5 field in signed requests, so the server does not verify that the received request body matches the signed digest. An attacker who captures a legitimate signed POST can keep the same query parameters and auth_signature, replace the body, and the handler will broadcast the tampered event to connected WebSocket clients. Because the authentication timestamp is also not checked, the replayed request can be reused indefinitely. The attacker can therefore forge server‑side events, alter application state, or send arbitrary messages within the affected application context.

AnyCable, a real‑time server supporting multiple back‑ends, is impacted whenever the REST API version in use is earlier than 1.6.15. Earlier releases such as 1.6.14 and older are vulnerable; the issue is fixed in version 1.6.15 and subsequent releases.

The CVSS score of 5.9 indicates medium impact, and because the EPSS metric is not available this vulnerability has not yet been seen as widely exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no known targeted attacks. The attack requires an attacker to intercept or obtain a signed request; once in possession, the replay is trivially possible without additional credentials. Thus the likelihood of exploitation is moderate, with immediate risk to confidentiality and integrity of messages sent through the real‑time channel.