CVE-2026-73655

CVE-2026-73655 is an account takeover vulnerability in Trigger.dev's Google OAuth implementation. The issue: when linking accounts across identity providers, the code matches users by email address but never verifies that Google's OAuth flow actually confirmed that email was valid. Google returns an email_verified claim, but Trigger.dev's account-linking logic ignores it entirely. An attacker with a Google account containing an unverified email matching a target's existing email can link their Google identity to the victim's account, gaining full access. This works because the code trusts that Google-issued emails are inherently verified — a reasonable mental shortcut under operational pressure, but exactly the kind of implicit trust that creates exploitable gaps. This is not an isolated flaw. The same account-linking-by-email-without-verification pattern has appeared in GitHub OAuth (2021), Slack integrations (2022), and Firebase setups. Each was patched with a single 'now we check email_verified' change. Each time, the underlying assumption that frameworks would encode this protection persisted in tutorials, starter templates, and library documentation — spreading the same vulnerability to the next platform that inherits the pattern. For Trigger.dev users, the blast radius extends beyond account access. Compromised accounts expose automation workflows, scheduled jobs, and integrations with customer systems, databases, and credential stores. An attacker doesn't just get a user profile — they get the keys to whatever infrastructure that user's agents were permitted to touch. The fix in version 4.5.2 adds an email_verified check, but the critical question is whether it makes verification mandatory or merely available as an option. If verification remains opt-in, the same implicit-trust pattern can re-emerge in other account-linking flows within the codebase. Audit other multi-provider auth paths for the same gap: if you're linking accounts by email, you must verify the incoming provider's email_verified claim is true, regardless of which identity provider issued the token.

Reviewed through automated stages and approved by a human before publication.