TREK EUVD-2026-65468

The attacker must possess valid primary credentials (username and password) for a TREK account - this is the explicit prerequisite encoded in PR:L of the CVSS 4.0 vector. The targeted TREK instance must be running a version at or below v3.0.22. The bypass specifically targets the Pre-2FA mfa_token handling stage, which is only reachable if the TREK deployment has multi-factor authentication configured or enforced; without 2FA enabled, this specific code path may not be triggered (though the authentication flow still passes through the vulnerable function). The attack is network-reachable (AV:N) with no required user interaction (UI:N) and no special attack prerequisites (AT:N). Exploitation is limited by: the requirement to possess valid first-factor credentials, the self-hosted nature of the software (no single central target), and absence of any known public exploit code at time of analysis.

The CVSS 4.0 score of 5.3 (Medium) reflects the PR:L prerequisite - an attacker must already possess a valid TREK account username and password before the bypass is achievable, meaningfully limiting the exposed attack surface compared to a fully unauthenticated bypass. The VC:L/VI:L/VA:L impact ratings are consistent with gaining unauthorized account access without escalating beyond the privilege level of the targeted user. However, the vendor's own characterization as 'critical' in the v3.1.0 release notes signals that the real-world consequence of bypassing 2FA - allowing account takeover of any user who has MFA enabled - is more impactful than the CVSS score alone suggests, particularly for self-hosted deployments storing sensitive travel itineraries or personal data. There is no CISA KEV listing and no public POC, indicating exploitation has not been observed at scale. EPSS data is absent from available intelligence. The practical risk is highest for TREK deployments where credential stuffing or prior credential compromise has occurred, since an attacker with stolen credentials could then trivially bypass the 2FA safety net.

An attacker who has obtained valid TREK credentials - through phishing, credential stuffing, or a prior breach of a user's password - initiates a login request against the TREK instance. Rather than completing the MFA challenge normally, the attacker manipulates the mfa_token value sent to the Pre-2FA handler in loginUser, exploiting the improper validation to satisfy the authentication check without possessing the legitimate second factor. The attacker then receives a valid session for the victim account. No public POC has been identified, but the low attack complexity (AC:L in CVSS 4.0) suggests the manipulation is straightforward once the flaw is understood.