Threats tagged 'ghsa-hqm2-cfx2-2vgh'

Pipecat's development runner exposes unauthenticated endpoints that can create bot sessions and paid Daily rooms if the runner is deliberately exposed to untrusted networks. The runner is designed only for local development and binds to localhost by default. Exploitation requires misconfiguration to expose it publicly. The impact includes potential resource consumption and exposure of room URLs and join tokens, but does not inherently grant access to external systems or sensitive data. Pipecat 1.6.0 clarifies this boundary and advises against using the development runner in production or exposing it to untrusted traffic.