CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.

• CWE-287

• https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
• https://github.com/triggerdotdev/trigger.dev/pull/4199
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-rp8c-h4xr-w9qv
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-rp8c-h4xr-w9qv

Published

Aug 13, 2026

Last Modified

Aug 18, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7365IBM Operations Analytics - Log Analysis  and IBM SmartCloud …7.8
• CVE-2026-73650SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-73651TypeORM is a TypeScript and JavaScript ORM for Node.js that …5.7
• CVE-2026-73652vantage6 is an open-source infrastructure for privacy preser…7.1
• CVE-2026-73653Vitest is a testing framework powered by Vite. Prior to vers…9.4
• CVE-2026-73654Trigger.dev is a platform for building and deploying fully m…8.5
• CVE-2026-73656Trigger.dev is a platform for building and deploying fully m…9.9
• CVE-2026-73657Trigger.dev is a platform for building and deploying fully m…4.2
• CVE-2026-73658Trigger.dev is a platform for building and deploying fully m…8.2
• CVE-2026-73659Trigger.dev is the open-source platform for building AI work…8.1
• CVE-2026-7366IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM Data…4.2
• CVE-2026-73660FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5…7.5