Description
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
triggerdotdev trigger.dev
< 4.5.2affected
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-rp8c-h4xr-w9qv ↗
- https://github.com/triggerdotdev/trigger.dev/pull/4199 ↗
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 ↗
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2 ↗