Trigger.dev before 4.5.5 contains a missing authentication check in the realtime streams POST handler, allowing unauthenticated attackers to inject arbitrary payloads into any stream. Attackers can target the endpoint /realtime/v1/streams/:runId/:streamId using a predictable run friendlyId, effectively overriding real‑time data in production or other environments. This flaw is a missing authentication weakness (CWE-306) and can lead to tampering with sensitive user data or misleading information being displayed to end‑users.

The vulnerability affects all installations of Trigger.dev up to, but not including, version 4.5.5. Any environment running a version earlier than 4.5.5 is potentially exposed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability under current threat conditions. The flaw is not yet listed in CISA’s KEV catalog, but its unauthenticated nature means an attacker can exploit it without credentials, provided they can deduce or guess a run friendlyId.