GHSA-r766-3v88-pfcf (where_is_waldo): where_is_waldo authenticates ActionCable connections from a client-supplied subject_id when no authenticate_proc is configured
26-Jul-2026 15
Originally appeared on RubySec.WhereIsWaldo::ApplicationCable::Connection (the gem's built-in ActionCable connection) authenticated the connection from `request.params[:subject_id]` whenever no `authenticate_proc` was configured. Because request params are client-controlled, a...
