CVE-2026-120425
Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
| CWE | CWE-639 |
| Vendor | munafio |
| Product | chatify |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for munafio chatify
Be the first to know when new medium vulnerabilities affecting munafio chatify are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
munafio / Chatify
0 < 1.6.4
References
github.com: https://github.com/munafio/chatify/issues/412 github.com: https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a github.com: https://github.com/munafio/chatify/releases/tag/v1.6.4 github.com: https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124 hackmd.io: https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass vulncheck.com: https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint hackmd.io: https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass
Credits
hieuPenguinnn