liketrek TREK CVE-2026-78885

Exploitation requires that the target TREK instance has OIDC authentication actively configured and enabled - instances relying solely on local username/password or passkey authentication are not exposed to this specific vulnerability. The CVSS 4.0 vector confirms no prior authentication is required (PR:N) and no user interaction is needed (UI:N), but the high attack complexity (AC:H) indicates that exploitation requires conditions beyond basic network access, such as knowledge of valid OIDC parameters, internal account identifiers, or specific manipulation of the OIDC callback flow. The flaw is triggered exclusively during the OIDC login flow via the findOrCreateUser function, bounding the attack surface to the OIDC callback endpoint. The high complexity requirement is the primary limiting factor defenders should weigh when prioritizing patching urgency on instances where OIDC is enabled.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) scores 6.3, reflecting network reachability and no authentication prerequisite, tempered by high attack complexity - the dominant risk-limiting factor. The low VC/VI/VA ratings suggest bounded impact per exploitation instance, likely scoped to individual user account takeover rather than full system compromise. No EPSS score was provided and the vulnerability is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis. Notably, the vendor's own release notes characterize this as a 'critical authentication bypass' - significantly stronger framing than the 6.3 CVSS score, suggesting the vendor considers the practical blast radius broader than the metric decomposition captures, possibly due to the self-hosted nature of the application (where admin-level account takeover is possible if an administrative account is targeted). Defenders should weight the vendor's critical classification alongside the CVSS score, particularly for instances where OIDC is configured against an identity provider that grants broad internal access.

A remote attacker targeting a self-hosted TREK instance with OIDC configured crafts a manipulated OIDC callback or token payload that triggers the flawed findOrCreateUser logic, causing the server to associate the authentication session with a victim user account rather than the attacker's own identity. Given the high attack complexity rating, successful exploitation likely requires knowledge of valid account identifiers or the ability to manipulate specific OIDC claim fields recognized by the server. No public proof-of-concept is available; this was privately reported and patched before public disclosure.