CVE-2026-114093

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Trigger.dev Leading to Session Termination

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114093

EUVD

EUVD-2026-106896

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Trigger.dev versions before 4.5.6. It allows attackers to force authenticated users to log out by sending them a specially crafted link. The logout action can be triggered via a simple GET request without requiring additional authentication or confirmation.

Detection Guidance

To detect this vulnerability, monitor network traffic for GET requests to the /logout endpoint from unauthorized sources. Check server logs for unusual logout events triggered by obfuscated or URL-encoded links. Inspect application code for GET-based logout endpoints in Trigger.dev versions before 4.5.6.

Impact Analysis

If exploited, this vulnerability can cause loss of unsaved work for users by forcing them to log out unexpectedly. Attackers can trick victims into clicking a malicious link, which terminates their active session without their consent.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by potentially causing unauthorized session termination. GDPR requires protecting user data and ensuring session integrity, while HIPAA mandates secure access controls. Session loss may lead to data exposure or unauthorized access if users are forced to log out unexpectedly.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.6 or later immediately. Change the logout endpoint from GET to POST to prevent CSRF attacks. Implement CSRF tokens for all state-changing requests. Review and restrict access to sensitive endpoints.

Hi! I’m here to help you understand CVE-2026-114093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...