This vulnerability in Trigger.dev allows a remote attacker to forcefully log out an authenticated user by triggering a GET request to the /logout endpoint. The attacker can craft an obfuscated, URL‑encoded link and entice the victim into clicking it via a phishing or malicious link. The immediate consequence is the termination of the victim’s session, leading to a loss of unsaved work. The security weakness is a classic CSRF flaw (CWE‑352).

Trigger.dev software, version 4.5.6 and earlier, from the vendor triggerdotdev:trigger.dev. No additional version detail is supplied, so all releases prior to 4.5.6 are assumed affected.

The CVSS score of 5.3 indicates moderate severity; the EPSS score of less than 1% suggests current exploitation probability is low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by simply sending a crafted GET request or by embedding the link in a malicious webpage. No authentication is required to trigger the logout, making it trivial to use in phishing attacks.