CVE-2026-114072
CVE-2026-114072 · Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
CVSS 5.3 · Moyenne · EPSS 0,1% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
trigger.dev
- Versions du logiciel
- ≥ 0, < 4.5.12: Concernée (semver)
- 4.5.12: Non concernée (semver)
Mettez à jour vers 4.5.12