AIKIDO-2026-11076

TL;DR

The LiveComponentHydrator computes an HMAC checksum over only the sorted prop key and value pairs without binding it to the originating component or to the slot identifier. A signature minted for one component can be replayed against another component that has matching property names, and a props blob signature can be replayed in the propsFromParent slot. This lets an attacker set read-only #[LiveProp] properties to attacker-controlled values that are normally only allowed as writable properties on different components. The fix binds the HMAC pre-image to the component name and to a slot identifier constant.