{"id":"CVE-2026-114072","published":"2026-10-21T01:17:31.053","lastModified":"2026-10-22T18:17:27.657","description":"The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-hc5h-gqhc-4h79","tags":[]},{"url":"https://www.vulncheck.com/advisories/trigger-dev-before-4.5.12-csrf-via-slack-oauth-callback-state","tags":[]}],"exploitRefs":[{"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-hc5h-gqhc-4h79","tags":[]}],"hasPoc":true,"ai":null}