Description
A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| liketrek | TREK | 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21, 3.0.22 | 3.1.0 |
References
- VDB-394941 | liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication vdb-entry technical-description
- VDB-394941 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-78885 | CVE Analysis and Report third-party-advisory
- Submit #886931 | mauriceboe TREK <= 3.0.22 Improper Authentication third-party-advisory
- https://github.com/mauriceboe/TREK/security/advisories/GHSA-fvgw-r58q-4cw4 related
- https://github.com/liketrek/TREK/releases/tag/v3.1.0 patch