Trigger.dev EUVD-2026-106896

Exploitation requires that the victim be an authenticated Trigger.dev user (session active in their browser) AND that they interact by loading an attacker-controlled link targeting the GET-based /logout endpoint (UI:P). The GET-accessible, non-CSRF-protected logout route is the specific vulnerable feature. Limiting factors: the attacker gains nothing without a currently-logged-in victim who clicks/loads the link, the impact is confined to session termination and loss of unsaved work (no data access or modification), and it is fixed in Trigger.dev 4.5.6, so patched or logged-out users are unaffected.

This is a low-to-moderate severity issue that should not be treated as an urgent priority. The only impact is availability-related and minor: a CSRF flaw (CWE-352) in a GET-based /logout endpoint lets a remote attacker terminate an authenticated victim's session, with no confidentiality or integrity impact (VC:N/VI:N, VA:L). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 5.3) is internally consistent: network-reachable, low complexity, no attacker privileges, but requires passive user interaction (the victim must click a crafted link). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The attack is technically trivial to construct but its worst outcome is forced logout and loss of unsaved work - a nuisance-grade denial of service against individual users rather than a systemic compromise. No CVSS 3.1 vector was supplied for cross-comparison; only the 4.0 vector is available. Bottom line: real but low-impact, mitigated by an available vendor patch; prioritize routine patching rather than emergency response.

An attacker crafts an obfuscated, URL-encoded link pointing to the victim's Trigger.dev /logout endpoint and embeds it in an email, chat message, or malicious web page. When a logged-in Trigger.dev user clicks the link (or loads a page auto-requesting the URL), their browser issues the GET request with their session cookie, terminating the session and discarding any unsaved work. No public exploit code was identified in the provided data, but the technique is trivial to reproduce.