CVE-2026-114093: Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session, causing loss of unsaved work.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated Trigger.dev users are exposed if their deployment is running a version before 4.5.6 and they can be induced to follow an attacker-controlled link.
What does an attacker need to exploit it?
The attacker does not need authentication or privileges, but must persuade an authenticated victim to click a link targeting the GET-based /logout endpoint. The link may be obfuscated or URL-encoded.
Is user interaction required?
Yes. Exploitation requires the victim to click the attacker-supplied link.
What is the impact of successful exploitation?
The victim's session is terminated, which can cause loss of unsaved work. The provided data does not indicate confidentiality or integrity impact.