Account Takeover Vulnerability in Trigger.dev Platform
CVE-2026-73655
What is CVE-2026-73655?
Trigger.dev, a platform designed for creating and deploying fully managed AI agents and workflows, has a significant vulnerability in its Google authentication process. Prior to version 4.5.2, the function addGoogleStrategy() allowed the passing of a Google profile email to the findOrCreateGoogleUser() function without validating the email's verification status. This flaw could permit an attacker to exploit an unverified Google profile email, leading to unauthorized account access. Specifically, if an existing email matched an account in the system, but the user was not recognized, the process would overwrite the existing account with the attacker’s Google authIdentifier, facilitating account takeover. This vulnerability has been addressed and resolved in version 4.5.2.
Affected Version(s)
trigger.dev < 4.5.2