CVE-2026-114072 — Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth …
Published: 2026-10-21 · CVSS: 5.3 · CVSS 4.0
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7