Live › vulnerability › CVE-2026-120425
Chatify before 1.6.4 has an authorization flaw in its Pusher channel authorization endpoint. An authenticated user can request a signature for another user's private channel and receive that user's incoming private messages and attachments in real time.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Applications that run Chatify before 1.6.4 with the Pusher channel authorization endpoint reachable by logged-in users. Anyone who has an account on such an app can read other users' private chat traffic, so the exposure is through the application's own users rather than unauthenticated visitors. Apps not using Chatify can skip it.
No product ranges from the sources yet.
1.6.4 are affected.1.6.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.
This page as .md · .json · in your agent: get_signal("CVE-2026-120425")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.