The vulnerability is a CSRF flaw in the organization‑level Slack OAuth flow of the Trigger.dev web application prior to version 4.5.12. By omitting a binding between the OAuth state and the user session, an attacker can cause an authenticated user to unintentionally authorize a malicious Slack workspace. This grants the attacker access to operational alerts from the victim organization, effectively enabling a covert data exfiltration vector. The weakness is classified as CWE‑352.

Trigger.dev webapp versions earlier than 4.5.12 are affected. The flaw exists in the organization Slack OAuth callback endpoint accessible at /integrations/slack/callback.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1 percent, implying that the probability of exploitation is low but not negligible. The vulnerability is not indexed in CISA’s KEV catalog, yet attackers could still exploit it if they obtain a target organization ID. The attack vector is inferred to be remote, as the malicious OAuth callback can be triggered by a user who opens a crafted link, requiring them to be authenticated to Trigger.dev.