Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account.
This issue is fixed in version 4.5.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
triggerdotdev:trigger.dev
References 4
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84…
security-advisories@github.com
https://github.com/triggerdotdev/trigger.dev/pull/4199
security-advisories@github.com
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
security-advisories@github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-rp8c-h4xr…
security-advisories@github.com