CVE-2026-114093

Overview

Trigger.dev versions prior to 4.5.6 allow attackers to trigger a cross‑site request forgery that logs out authenticated users via a GET /logout endpoint. The vulnerability can be abused by sending a crafted link that terminates a victim’s session, causing loss of unsaved work. It is a medium‑severity flaw that can disrupt user productivity.

Description

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.

Impact

The flaw compromises availability by forcibly terminating user sessions, potentially leading to loss of unsaved data. While confidentiality and integrity are not directly breached, the disruption can affect team collaboration and project timelines. Defenders should treat it as a moderate risk to user experience and operational continuity.

Remediation

Upgrade Trigger.dev to version 4.5.6 or later, where the /logout endpoint no longer accepts GET requests and requires a CSRF token. As an interim measure, block or monitor GET requests to /logout, enforce same‑site cookie attributes, and implement CSRF protection on all state‑changing endpoints.

Risk context

The CVSS v3 score of 4.3 indicates a medium impact, and no EPSS data is available. Defenders should consider this a moderate‑urgency issue, especially for teams relying on real‑time collaboration features.

Affected products

• Trigger.dev <4.5.6