CVE-2026-120425
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel…
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to r…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124
- https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a
- https://github.com/munafio/chatify/issues/412
- https://github.com/munafio/chatify/releases/tag/v1.6.4
- https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass
- https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint
- https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass
Original description
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
Last activity 2 Nov 2026. Patch Forecast updates every hour.