CVE-2026-114093 in Trigger.dev
Summary
by MITRE • 10/22/2026
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw in Trigger.dev versions prior to 4.5.6 constitutes a classic Cross-Site Request Forgery vulnerability centered on the application's authentication management mechanisms. Specifically, the /logout endpoint relies entirely on HTTP GET requests rather than POST or other state-changing methods that require explicit user interaction beyond simple navigation. This architectural decision violates fundamental web security principles regarding safe idempotent operations and exposes users to session hijacking through social engineering tactics. The vulnerability stems from the absence of anti-CSRF tokens, origin validation checks, or same-site cookie attributes on this critical endpoint, allowing external domains to trigger state changes within the user's authenticated context without their knowledge or consent.
From a technical perspective, the exploitation vector involves crafting a malicious URL that points directly to the /logout path with appropriate parameters if any are required by the specific implementation. Because HTTP GET requests are designed for retrieving data and do not carry payloads in the body, they can be easily embedded within HTML image tags, script sources, or hyperlinks on an attacker-controlled website. When an authenticated user visits this malicious page while still logged into Trigger.dev, their browser automatically includes any associated session cookies with the request to the /logout endpoint due to standard cookie policy enforcement. The server interprets this as a legitimate logout action from the valid user, thereby terminating the active session without requiring additional verification steps such as re-authentication or explicit confirmation dialogs that are typically expected for sensitive operations.
The operational impact of this vulnerability is primarily focused on availability and data integrity rather than direct unauthorized access to private data. By forcing users out of their sessions, attackers can cause a denial of service effect at the individual user level, resulting in the loss of unsaved work or interruption of ongoing tasks within the Trigger.dev platform. While the immediate consequence is session termination, this behavior can serve as a precursor for more severe attacks. For instance, an attacker might use CSRF to log out a victim and then immediately redirect them to a phishing page that mimics the login interface, potentially capturing credentials if the user re-authenticates under false pretenses. Furthermore, in environments where session state is tightly coupled with workflow execution or temporary data storage, forced logout can lead to significant productivity losses and potential corruption of incomplete processes.
This vulnerability maps directly to CWE-352, which defines Cross-Site Request Forgery as a flaw allowing an attacker to cause a user to perform unintended actions on a trusted web application. Additionally, the exploitation technique aligns with MITRE ATT&CK tactic T1078, specifically referencing valid accounts and authentication bypass techniques where the adversary manipulates the session lifecycle rather than breaking cryptographic protections. The use of obfuscated or URL-encoded links further supports detection patterns associated with social engineering campaigns aimed at disrupting user sessions.
To mitigate this vulnerability, developers must implement robust anti-CSRF measures for all state-changing endpoints, including logout functionality. This includes integrating unique, unpredictable CSRF tokens that are validated server-side on every request originating from a different origin. Alternatively, the application should enforce SameSite cookie attributes set to Strict or Lax, which prevent browsers from sending cookies in cross-site requests by default. Another effective strategy is to require POST requests with Content-Type headers for logout actions and ensure these endpoints do not respond to GET requests at all. Regular security audits focusing on authentication flows and adherence to OWASP guidelines are essential to maintain the integrity of session management systems and protect users against such manipulation tactics.