Auth bypass in Triggerdotdev Trigger.dev
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
Vulnerability class: IDOR (Insecure Direct Object Reference)
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- GitHub Security Advisory (GHSA-9rx3-j5hm-5f27) (vendor-advisory, third-party-advisory)
- linkGitHubAppInstallation performs no ownership check at the last affected release (technical-description)
- 4.6.0 adds verifyGitHubAppInstallationAccess (patch)
- disclosure@vulncheck.com (product)
- VulnCheck Advisory: Trigger.dev before 4.6.0 GitHub App Installation Takeover (third-party-advisory)
Frequently asked questions
- What is CVE-2026-92773?
- CVE-2026-92773 is a high-severity vulnerability in Triggerdotdev Trigger.dev, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.1/10. Published 2026-09-16.
- How severe is CVE-2026-92773?
- High severity. CVSS v3 base score is 7.1 out of 10.