What is the CVSS score of CVE-2026-73655?

CVE-2026-73655 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Trigger.dev are affected by CVE-2026-73655?

Trigger.dev versions prior to 4.5.2 are vulnerable to unauthenticated account takeover affecting users who have not linked a Google OAuth identity.. A patch is available.

How to fix or mitigate CVE-2026-73655?

Within 24 hours, audit your Trigger.dev deployment to confirm the running version and identify users without Google OAuth linked. Within 7 days, upgrade all instances to Trigger.dev v4.5.2 or later-this is mandatory as the vulnerability affects any unauthenticated attacker with knowledge of user email addresses. Within 30 days, force password resets for all users who lacked Google OAuth configuration during the exposure window, audit access logs for the past 90 days for suspicious authentication patterns or account modifications, and enable mandatory multi-factor authentication if not already enforced.

Trigger.dev CVE-2026-73655

EUVD-2026-58383 HIGH

Improper Authentication (CWE-287)

2026-08-13 GitHub_M

Google Authentication Bypass Trigger Dev

7.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

AC:H reflects the prerequisite of controlling a Google account with an unverified matching email; PR:N as no prior Trigger.dev authentication is required; A:N since availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 13, 2026 - 21:20 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 20:41 vuln.today

Analysis Generated

Aug 13, 2026 - 20:41 vuln.today

CVE Published

Aug 13, 2026 - 19:53 cve.org

HIGH 7.4

DescriptionCVE.org

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.

AnalysisAI

Account takeover in Trigger.dev before 4.5.2 allows an unauthenticated remote attacker to hijack any existing user account that has not yet linked a Google OAuth identity, by presenting a Google profile whose email is unverified but matches the victim's registered address. The addGoogleStrategy() function in apps/webapp/app/services/googleAuth.server.ts omits the email_verified assertion before calling findOrCreateGoogleUser(), causing the server to bind the attacker's Google authIdentifier to the victim's account when the conditional existingEmailUser && !existingUser is satisfied. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify victim's registered Trigger.dev email

Delivery

Create Google account with matching unverified email

Exploit

Initiate Google OAuth login on target Trigger.dev instance

Execution

email_verified assertion bypassed in addGoogleStrategy()

Persist

Attacker Google authIdentifier written to victim account

Impact

Attacker authenticated as victim with full account access

Access

Identify victim's registered Trigger.dev email

Delivery

Create Google account with matching unverified email

Exploit

Initiate Google OAuth login on target Trigger.dev instance

Execution

email_verified assertion bypassed in addGoogleStrategy()

Persist

Attacker Google authIdentifier written to victim account

Impact

Attacker authenticated as victim with full account access

Vulnerability AssessmentAI

Exploitation	Google OAuth authentication must be enabled on the Trigger.dev instance (`addGoogleStrategy()` must be active in the webapp configuration). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.4 High with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N is well-calibrated: the High attack complexity (AC:H) reflects that the attacker must know the victim's registered email and must be able to present a Google account with that exact unverified email, which is a non-trivial prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker identifies the email address of a Trigger.dev user whose account is not yet linked to a Google OAuth identity - discoverable through phishing, data breaches, or publicly known email addresses. The attacker creates or uses a Google account with that same email address left in an unverified state, then initiates the Google OAuth login flow on the target Trigger.dev instance. …
Remediation	Vendor-released patch: Trigger.dev v4.5.2 resolves this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.