Trigger.dev before version 4.6.2 contains an authorization flaw that allows any entity possessing a public token with session write permissions to obtain S2 stream credentials by initializing session input. With these credentials an attacker can freely append, create, or remove session and run streams, forging output or deleting data. The weakness is based on missing authorization checks (CWE-862).

Trigger.dev, any deployment running a version earlier than 4.6.2 of the trigger.dev platform. Users of the affected environment who possess public tokens with write access are automatically vulnerable.

The CVSS score of 7.2 classifies this as a high‑severity vulnerability. The EPSS rating of < 1% suggests that exploitation attempts are currently rare. Because the vulnerability is not listed in CISA's KEV catalog, there is no confirmed exploitation in the wild. An attacker would need to control a public token that grants write access, so the attack vector can be considered internal but potentially reachable through compromised or misconfigured credentials. Once the credentials are obtained, the impact is complete data tampering and potential loss of integrity across the entire environment.