Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.4...