CVE-2025-9036 A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token

Description

A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.

Affected products and versions