{"id":"CVE-2026-114089","aliases":["GHSA-58mc-m3qq-6qrh"],"url":"https://o3.security/vulnerability/CVE-2026-114089","summary":"Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover","details":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.","published":"2026-10-21T00:36:54.860Z","modified":"2026-10-21T10:45:46.127654924Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114089.json"},{"type":"ADVISORY","url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-58mc-m3qq-6qrh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114089"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-cli-auth-code-phishing-leading-to-pat-takeover"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T10:45:46.127654924Z"}}