# Trigger.dev: V1 coordinator default-secret unauth Socket.IO

Trigger.dev self-hosts shipped a hardcoded coordinator Socket.IO secret, letting anyone read decrypted run env vars and forge run completions.

- Payout: Research
- Severity: critical
- Program: Trigger.dev
- Found by: lissy93
- Disclosed: 2026-10-02
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-gg6r-gp4c-89hp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-gg6r-gp4c-89hp
- Tags: area:web3 domain:oss impact:data-leak impact:integrity kind:research platform:ghsa sev:critical tech:nodejs tech:websocket technique:default-creds technique:source-review vuln:access-control vuln:auth-bypass vuln:secrets-leak

**Target:** Socket.IO /coordinator namespace on self-hosted webapp
**Root cause:** COORDINATOR_SECRET/PROVIDER_SECRET default to published strings ("coordinator-secret"/"provider-secret") in env.server.ts, undocumented in self-host config, and the namespace auth is a plain string compare; handlers also lack per-run authorization.
**Steps:**
1. Connect to `https://<target>/coordinator` with `auth: { token: "coordinator-secret" }` over websocket.
2. Emit `READY_FOR_EXECUTION` with `{ runId: "<runId>", totalCompletions: 0 }` and read `res.payload.environment` for decrypted env vars.
3. Emit `TASK_RUN_FAILED_TO_RUN` with a forged completion using an `attempt_*` friendlyId to corrupt arbitrary runs.
**How found:** Source review of env.server.ts defaults and zodNamespace.ts auth check, noticing the secret defaults were absent from self-hosting docs, .env.example and helm values.
**Exploitation:** Attacker with network reach to a default-config self-hosted webapp authenticates to the coordinator namespace using the published default secret, then exfiltrates decrypted env vars (DATABASE_URL, STRIPE_SECRET_KEY, OPENAI_API_KEY) for any known runId, and forges completion/failure/worker events against arbitrary attempt friendlyIds leaked in dashboard URLs and alert emails.
**Escalation:** Env-var exfil yields database and third-party API credentials; write handlers allow integrity attacks on any tenant's runs.
**Insight:** Grep self-hosted repos for `.default(` on secret env vars and cross-check whether the override is documented in .env.example/helm values — undocumented defaults mean most operators ship the published value. Also check Socket.IO namespace auth for plain string compares and per-object authorization on each event handler.