Trigger.dev CVE-2026-73655

Google OAuth authentication must be enabled on the Trigger.dev instance (addGoogleStrategy() must be active in the webapp configuration). The victim's Trigger.dev account must exist with a registered email address but must NOT already have a Google OAuth identity linked - the vulnerable branch existingEmailUser && !existingUser is only triggered when a matching email account exists without a prior Google link. The attacker must know the exact email address of a target Trigger.dev user. The attacker must be able to present a Google OAuth profile containing that email address in an unverified state - Google must permit the OAuth flow for an account where email verification has not been completed. Exploitation is blocked for accounts that already have a Google identity linked, for instances where Google OAuth is disabled, and for attackers who cannot obtain a Google profile with a matching unverified email. No Trigger.dev authentication is required prior to exploitation.

The CVSS 3.1 score of 7.4 High with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N is well-calibrated: the High attack complexity (AC:H) reflects that the attacker must know the victim's registered email and must be able to present a Google account with that exact unverified email, which is a non-trivial prerequisite. The PR:N assignment is accurate because no Trigger.dev credentials are needed by the attacker - the exploit occurs entirely through the OAuth callback. The C:H/I:H impact is appropriate given that a successful attack yields complete account takeover including access to all workflows, API keys, connected integrations, and agent configurations. EPSS data was not provided, so quantitative exploitation probability cannot be assessed. CISA KEV status is not confirmed, and no public POC has been identified at time of analysis. Despite the lack of confirmed exploitation, the severity of the impact (full account takeover), the network-accessible attack surface, and the absence of any required victim interaction make this a genuine priority for Trigger.dev operators using Google OAuth. The primary real-world limiting factor is the prerequisite of having a Google account with an unverified matching email, which reduces opportunistic exploitation but does not eliminate targeted attacks.

An attacker identifies the email address of a Trigger.dev user whose account is not yet linked to a Google OAuth identity - discoverable through phishing, data breaches, or publicly known email addresses. The attacker creates or uses a Google account with that same email address left in an unverified state, then initiates the Google OAuth login flow on the target Trigger.dev instance. Since the webapp does not enforce email_verified, it matches the attacker's Google profile to the victim's account via email, binds the attacker's Google identity to it, and authenticates the attacker as the victim with full account privileges.