CVE-2026-73655

HIGH 7.4

Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.

CWE	CWE-287
Vendor	triggerdotdev
Product	trigger.dev
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for triggerdotdev trigger.dev

Be the first to know when new high vulnerabilities affecting triggerdotdev trigger.dev are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

triggerdotdev / trigger.dev

< 4.5.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-rp8c-h4xr-w9qv github.com: https://github.com/triggerdotdev/trigger.dev/pull/4199 github.com: https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 github.com: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2