---
id: CVE-2026-114072
title: Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
summary: >-
  The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery
  vulnerability in its organization-level Slack OAuth flow, which uses the
  organization ID as the OAuth state without binding it to the initiating
  session. Attacker…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.12
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:43.024Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114072'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-hc5h-gqhc-4h79
    label: GitHub Security Advisory (GHSA-hc5h-gqhc-4h79)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.12-csrf-via-slack-oauth-callback-state
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.12 CSRF via Slack OAuth
      Callback State
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.026Z'
---

## Overview

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.

## Affected

- `trigger.dev < 4.5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.