Threats tagged 'ghsa-ppjp-65hc-5g55'

Chatify versions before 1.6.4 have an authorization bypass vulnerability in the Pusher channel authorization endpoint. This flaw allows authenticated users to subscribe to private channels of other users by supplying arbitrary channel names. Exploiting this, an attacker can receive the victim's incoming private messages and attachments in real time.