CyberRota Analysis
AI-GeneratedTrigger.dev versions prior to 4.6.0 are vulnerable as they do not properly verify that an authenticated user controls a GitHub App installation before associating it with their organization. This flaw allows attackers to exploit replayed state cookies and sequential installation identifiers to hijack another user's GitHub App installation, potentially leading to unauthorized access to sensitive repositories. Organizations using Trigger.dev should prioritize this vulnerability to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.