CVE-2026-73655 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev installations, security teams, and administrators should assess exposure to this vulnerability and prioritize upgrading to version 4.5.2 or later to prevent account takeovers.

Why it matters

CVE-2026-73655 is a high-severity vulnerability in Trigger.dev that allows an attacker to take over an account, potentially leading to unauthorized access and data breaches. Defenders should prioritize verifying exposure and upgrading to version 4.5.2 or later.

• Potential account takeover and unauthorized access
• Possible data breaches due to compromised accounts
• Need for verification of Trigger.dev installations and upgrades

Technical summary

The CVE-2026-73655 vulnerability in Trigger.dev allows an attacker to take over an account by exploiting the addGoogleStrategy function, which does not require Google's email_verified assertion. This issue was fixed in version 4.5.2. The vulnerability has a CVSS score of 7.4 and is considered HIGH severity. Defenders should prioritize verifying exposure of Trigger.dev installations to this vulnerability and upgrading to version 4.5.2 or later to prevent account takeovers, which could lead to unauthorized access and data breaches.

Defensive priority

Defenders should prioritize verifying exposure of Trigger.dev installations to this vulnerability and upgrading to version 4.5.2 or later. Account takeovers could lead to unauthorized access and data breaches.

Recommended defensive actions

• Verify Trigger.dev installations for exposure to CVE-2026-73655
• Upgrade Trigger.dev to version 4.5.2 or later
• Monitor for unauthorized account access and data breaches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.4 and HIGH severity. The issue is caused by the addGoogleStrategy function in googleAuth.server.ts, which allows an attacker-controlled Google profile with an unverified matching email to take over an account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.