Trigger.dev Google OAuth Account Takeover via Unverified Email

Technical Analysis

The vulnerability lies in addGoogleStrategy() (googleAuth.server.ts) which passes the Google profile's email to findOrCreateGoogleUser() without verifying Google's email_verified assertion. When an existing local/email-based account matches the unverified email and no existing Google-linked user is found, the code binds the attacker's Google identity (authIdentifier) to the victim's existing account and returns that user object as authenticated. An attacker only needs to register a Google account using an email address they don't actually own/control verification for (e.g., via a Google Workspace domain they administer or an email provider allowing spoofed registration) matching a victim's Trigger.dev account email. Once linked, the attacker gains full session access to the victim's account, including any deployed AI agents, workflow secrets, environment variables, and API tokens managed through the platform — effectively a privilege escalation from an external identity into an internal agent-management account.

Affected Systems

Trigger.dev; protocols: OAuth 2.0

Detection Signatures

• Login events where a new Google authIdentifier is bound to a pre-existing local/email account without prior Google linkage
• Authentication logs showing existingEmailUser && !existingUser branch triggered
• Unexpected changes to account authIdentifier or linked-provider fields outside of user-initiated 'link account' flows
• Logins from previously unseen Google Workspace domains for accounts with sensitive agent/workflow permissions
• Spike in new-account creation immediately followed by authentication as a pre-existing higher-privilege account

Remediation Steps

1. 1

   Upgrade Trigger.dev

   Update to version 4.5.2 or later, which enforces Google's email_verified check before linking or auto-provisioning accounts.

2. 2

   Enforce email_verified checks

   Ensure all OAuth/OIDC integrations explicitly validate the email_verified claim before using email as an account-matching key.

3. 3

   Audit existing account linkages

   Review authentication logs for accounts that had a Google identity linked via auto-matching and confirm legitimacy; force re-verification or password reset where suspicious.

4. 4

   Require explicit account linking

   Do not auto-merge OAuth identities into existing accounts based solely on email match; require the user to be logged in and explicitly confirm linking.

5. 5

   Rotate secrets for affected accounts

   For any account showing signs of unauthorized linkage, rotate API keys, workflow secrets, and agent credentials managed through Trigger.dev.