CVE-2026-120425 Details
Description
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
A vulnerability allowing authorization bypass in Chatify private channels has been identified in versions prior to 1.6.4. This issue arises in the Pusher channel authorization endpoint, where authenticated users can subscribe to other users' private channels by providing arbitrary channel names. The vulnerability allows attackers to intercept real-time private messages and attachments intended for the victim. Exploitation involves requesting a signature for the victim's private channel through the authorization endpoint, using the victim's user ID.
Users can update to Chatify version 1.6.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass | CISA-ADP | Technical Analysis |
| https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124 | [email protected] | Source CodeVendor |
| https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a | [email protected] | Source CodeVendor |
| https://github.com/munafio/chatify/issues/412 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/munafio/chatify/releases/tag/v1.6.4 | [email protected] | Release NotesVendor |
| https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chatify | < 1.6.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |