Summary
A caller with a public access token granting write access to a realtime session could initialize that session's input stream and receive a storage credential scoped to all realtime streams in the same environment, rather than only the authorized input stream.
This affected deployments using the S2 realtime backend.
Impact
The credential permitted appending records, creating streams, and trimming stream data. A caller could use it to forge output in their own session and, if they knew another stream's name, modify or trim other session and run streams in the same environment.
Trimming could permanently remove records from the affected realtime streams. The credential did not grant read access.
Details
Session input initialization correctly checked the caller's access to the requested session, but the returned storage credential used an environment-wide stream-prefix scope.
Restricting output initialization to secret-key authentication did not fully address the issue: public-token callers could still obtain the broad credential through input initialization and use it directly against the storage API.
Incomplete remediation
The original remediation restricted session output initialization to secret-key authentication. It did not narrow the storage credentials returned by session input initialization, which remained available to public tokens with session write access.
Consequently, the previously listed patched version, 4.5.6, did not fully resolve the vulnerability. The complete fix is included in version 4.6.2.
Patches
Upgrade all server instances to version 4.6.2 or later. Updating SDK packages alone does not apply this server-side fix.
The fix scopes session credentials to the exact authorized stream, including the channel name where applicable. Input credentials permit only append and stream creation; output credentials retain trimming permission only for their exact stream.
The credential cache has also been updated so fixed servers do not reuse previously cached, overly broad credentials.
Previously issued credentials remain valid until revoked or expired. After upgrading all instances, revoke affected credentials or allow their full configured lifetime to elapse after the last vulnerable instance stops issuing them. The default lifetime is 24 hours. The vulnerability remains exploitable through those credentials until revocation or expiry.
Workarounds
Until an upgrade is possible, prevent untrusted callers from initializing session streams. This disrupts session input functionality and does not invalidate credentials already issued; those must also be revoked or expire.
DavidCarliez Reporter
sajdakabir Finder
Summary
A caller with a public access token granting write access to a realtime session could initialize that session's input stream and receive a storage credential scoped to all realtime streams in the same environment, rather than only the authorized input stream.
This affected deployments using the S2 realtime backend.
Impact
The credential permitted appending records, creating streams, and trimming stream data. A caller could use it to forge output in their own session and, if they knew another stream's name, modify or trim other session and run streams in the same environment.
Trimming could permanently remove records from the affected realtime streams. The credential did not grant read access.
Details
Session input initialization correctly checked the caller's access to the requested session, but the returned storage credential used an environment-wide stream-prefix scope.
Restricting output initialization to secret-key authentication did not fully address the issue: public-token callers could still obtain the broad credential through input initialization and use it directly against the storage API.
Incomplete remediation
The original remediation restricted session output initialization to secret-key authentication. It did not narrow the storage credentials returned by session input initialization, which remained available to public tokens with session write access.
Consequently, the previously listed patched version, 4.5.6, did not fully resolve the vulnerability. The complete fix is included in version 4.6.2.
Patches
Upgrade all server instances to version 4.6.2 or later. Updating SDK packages alone does not apply this server-side fix.
The fix scopes session credentials to the exact authorized stream, including the channel name where applicable. Input credentials permit only append and stream creation; output credentials retain trimming permission only for their exact stream.
The credential cache has also been updated so fixed servers do not reuse previously cached, overly broad credentials.
Previously issued credentials remain valid until revoked or expired. After upgrading all instances, revoke affected credentials or allow their full configured lifetime to elapse after the last vulnerable instance stops issuing them. The default lifetime is 24 hours. The vulnerability remains exploitable through those credentials until revocation or expiry.
Workarounds
Until an upgrade is possible, prevent untrusted callers from initializing session streams. This disrupts session input functionality and does not invalidate credentials already issued; those must also be revoked or expire.