PT-2026-111184

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...