Executive brief
Trigger.dev before version 4.6.0 fails to properly validate that a user owns a GitHub App installation before linking it to an organization. An attacker can hijack another user's GitHub App installation by replaying authentication cookies and guessing sequential installation IDs, gaining unauthorized access to the victim's repositories and potentially compromising the entire GitHub integration for an organization.
Technical details
The vulnerability is an authentication bypass / privilege escalation in GitHub App integration. Trigger.dev fails to verify that the authenticated user actually controls the GitHub App installation before binding it to their organization. The root cause is insufficient validation of installation ownership combined with predictable (sequential) installation identifiers. An attacker can exploit this by replaying state cookies from previous OAuth flows and supplying sequential installation IDs to claim installations belonging to other users. This requires network access to the Trigger.dev web application but no special user interaction beyond authentication. The fix is available in version 4.6.0 and later.
Affected products
- Trigger.dev Trigger.dev before 4.6.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 4.6.0