Live › vulnerability › CVE-2026-114093
Go to dashboardTrigger.dev versions before 4.5.6 expose a GET-based /logout endpoint that accepts cross-site requests. A remote attacker can send a link that ends a signed-in user's session, which can lose unsaved work.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a Trigger.dev instance below 4.5.6 where users sign in through the web dashboard. The risk is a forced logout from a crafted link, not data theft. Users of managed hosting who do not run their own instance are handled by the vendor; the sources do not say whether hosted instances were patched on a specific date.
No product ranges from the sources yet.
4.5.6/logout route on your self-hosted or app deployment and confirm whether it responds to GET requests4.5.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.
This page as .md · .json · in your agent: get_signal("CVE-2026-114093")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.