CVE-2026-73655

Received Received - Intake

Authentication Bypass in Trigger.dev via Unverified Google Email

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73655

EUVD

EUVD-2026-58383

Affected Vendors & Products

Vendor	Product	Version / Range
trigger.dev	trigger.dev	4.5.2
trigger.dev	trigger.dev	to 4.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-73655 is an Account Takeover vulnerability in Trigger.dev affecting versions 4.5.1 and earlier. It occurs during Google OAuth login where the system links an attacker's Google account to an existing victim's account if they share the same email address without verifying ownership. The vulnerability exists in the findOrCreateGoogleUser() function which updates the victim's account with the attacker's OAuth credentials when no existing Google user is found but the email matches an existing account.

Impact Analysis

An attacker can gain full access to the victim's projects, tasks, runs, API keys, environment variables, and ability to manage organizations. The attack requires no special privileges or user interaction and allows persistent access to the compromised account.

Mitigation Strategies

Upgrade to Trigger.dev version 4.5.2 or later to address the vulnerability and apply all security hardening changes.

Verify that email verification is enforced during Google OAuth login to prevent account takeover.
Check for unauthorized access or linked accounts by reviewing user accounts and OAuth credentials in the admin panel.

Hi! I’m here to help you understand CVE-2026-73655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70