Live › vulnerability › CVE-2026-114089
Go to dashboardTrigger.dev <=4.5.1: loading /account/authorization-code/<code> as a logged-in user mints a Personal Access Token with no consent step; the attacker, who created the code via the unauthenticated API, collects the PAT from /api/v1/token and takes over the account. The same advisory reports missing org-role checks and a cross-org removeTeamMember IDOR, which make a stolen PAT more damaging. Reporter says it hits the managed cloud and self-hosted instances.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| trigger.dev | npm | <= 4.5.1 | 4.5.2 |
4.5.1 is affected4.5.2 or later (4.5.6 adds explicit browser approval for CLI/MCP login)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-114089")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.