CVE-2026-73655

HighCVSS 7.4

Published: 13/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Trigger.dev before version 4.5.2 contains a vulnerability in addGoogleStrategy() that passes a Google profile email to findOrCreateGoogleUser() without requiring Google's email_verified assertion. When an existing email-matched account exists, an attacker can take over the account using an unverified matching email from their own Google profile.

Risk Assessment

An attacker could take over user accounts, leading to unauthorized access to platform data and functionality.

Recommendation

Upgrade Trigger.dev to version 4.5.2 or later, which includes the fix.

Original NVD description (English source)

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.