Trigger.dev before version 4.5.2 allows an attacker to exploit a cross‑site request forgery flaw in the command‑line authorization‑code flow. By creating an unauthenticated authorization code and directing a logged‑in user to the URL /account/authorization-code/<code>, the system generates a Personal Access Token (PAT) without any explicit user consent. The attacker can then query the unauthenticated /api/v1/token endpoint to retrieve this PAT, which grants full account privileges. The effect is that an adversary can control the victim’s account by stealing the PAT.

All users of Trigger.dev CLI whose installations are running a release earlier than 4.5.2 are impacted. The vulnerability is present in the trigger.dev product distributed under the triggerdotdev:trigger.dev identifier and applies to the entire CLI authorization‑code flow before the 4.5.2 fix was released.

The CVSS score of 8.7 marks this as a high‑severity vulnerability, while the EPSS score of < 1% indicates a low probability of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure a logged‑in user to a crafted URL, a phishing‑style attack that is inferred from the description of feeding the victim a forged link. Successful exploitation yields a PAT with broad privileges and effectively full account takeover. No remote code execution or denial of service is described, but the impact is the compromise of the entire account. The exploitation chain requires no elevated privileges on the user’s machine, relying solely on the user’s authentication token being present in their browser session.