Moyenne
4.3
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its...
CVE-2026-114072
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com