Authentication Bypass in Trigger.dev via GitHub App Installation Binding

Trigger.dev versions prior to 4.6.0 contain a critical vulnerability related to how the platform validates the ownership of GitHub App installations during the binding process. The vulnerability stems from a failure to verify that an authenticated user actually controls or owns the GitHub App installation before associating it with their organization within the Trigger.dev platform.

An attacker can exploit this flaw by leveraging sequential installation identifiers combined with the replay of state cookies. By predicting or brute-forcing installation IDs and interacting with the authorization flow, an attacker can trick the system into binding a victim's GitHub App installation to the attacker's own organization. This results in the attacker gaining unauthorized access to the victim's GitHub repositories, effectively achieving account and resource takeover. This flaw represents a significant risk for organizations using Trigger.dev for workflow automation, as it allows for unauthorized access to sensitive source code and environment secrets.

Impact

The vulnerability allows unauthorized access to GitHub repositories belonging to other users or organizations. If exploited, an attacker can gain the permissions granted to the hijacked GitHub App installation, potentially allowing for the theft of source code, environment secrets, or the manipulation of CI/CD pipelines connected to Trigger.dev.

Recommendation

Prioritize the upgrade of Trigger.dev to version 4.6.0 or later to address the underlying authentication logic flaw in the GitHub App installation binding process.

• Upgrade Trigger.dev to version 4.6.0 or later immediately to patch CVE-2026-92773.
• Audit existing GitHub App installations within the Trigger.dev dashboard for any unknown or unauthorized organization associations.
• Review GitHub App permissions granted to the Trigger.dev integration to ensure minimal privilege is applied.