Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120425Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Chatify from munafio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

Affected products (as reported)

Vendor	Product	Versions
munafio	Chatify	0 – before 1.6.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/munafio/chatify/issues/412 issue-tracking
https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a patch
Chatify v1.6.4 Release Notes release-notes
https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124 technical-description
https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass technical-description
VulnCheck Advisory: Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint third-party-advisory
https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass exploit