Advisories for Golang/Github.com/Anycable/Anycable package

The telemetry subsystem embeds a hardcoded auth token ("secret") in the public source and transmits raw CLI arguments—including –secret, –jwt_secret, and –http_rpc_secret values—to a third-party telemetry endpoint.

The Pusher-compatible REST API includes body_md5 in the HMAC signature string but never computes or verifies the MD5 of the received HTTP body, allowing anyone who observes a signed request to replay it with an entirely different body.