The vulnerability in Trigger.dev’s Google authentication flow allows an attacker to associate a new Google account that has the same email address as an existing user but whose email is not verified. Because the addGoogleStrategy function does not check Google’s email_verified flag, the new OAuth identifier is written to the existing user, effectively hijacking the account and granting the attacker full control over the original user’s data and permissions. This is a classic authentication bypass that results in a loss of confidentiality, integrity, and availability for the compromised account.

Trigger.dev users utilizing versions earlier than 4.5.2 are affected. The specific code paths involve addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts and findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts. All users of the Trigger.dev platform that have enabled Google login prior to the release of 4.5.2 are at risk.

The CVSS score of 7.4 indicates a high impact vulnerability. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not yet widely exploited. Still, the attack can be carried out by simply creating a Google account with an unverified email that matches a target account, leveraging the OAuth redirect flow. The lack of an email_verified check creates a clear path for exploitation, and the vulnerability remains fully exploitable until the patch is applied.