---
id: CVE-2026-120425
title: Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint
summary: >-
  Chatify before 1.6.4 contains an authorization bypass vulnerability in the
  Pusher channel authorization endpoint that allows authenticated users to
  subscribe to other users' private channels by supplying arbitrary channel
  names. Attacker…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: munafio
product: Chatify
affected:
  - Chatify < 1.6.4
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T15:52:04.247974Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:52:24.365Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120425'
references:
  - url: 'https://github.com/munafio/chatify/issues/412'
  - url: >-
      https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a
  - url: 'https://github.com/munafio/chatify/releases/tag/v1.6.4'
    label: Chatify v1.6.4 Release Notes
  - url: >-
      https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124
  - url: 'https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass'
  - url: >-
      https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint
    label: >-
      VulnCheck Advisory: Chatify before 1.6.4 Pusher Authorization Bypass via
      /chat/auth Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00521
epssPercentile: 0.44499
ingestedAt: '2026-11-05T19:30:42.697Z'
---

## Overview

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

## Affected

- `Chatify < 1.6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.