CVE-2026-73655

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2

Description Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. The addGoogleStrategy() function in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to the findOrCreateGoogleUser() function in apps/webapp/app/models/user.server.ts without verifying the email verified assertion from Google. If a condition where an email matches an existing user but the Google account is not yet linked is met, the system writes the new Google authentication identifier into the existing account. This allows an attacker to take over an account by using a Google profile with an unverified email that matches the target user's email.

Recommendations Update to version 4.5.2.