EUVD-2026-65473
GHSA-q5wr-f3rq-qfcg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable OIDC bypass requires no auth but high complexity; scope unchanged and impact bounded to individual user account access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.
AnalysisAI
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the findOrCreateUser function of server/src/services/oidcService.ts. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target TREK instance has OIDC authentication actively configured and enabled - instances relying solely on local username/password or passkey authentication are not exposed to this specific vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) scores 6.3, reflecting network reachability and no authentication prerequisite, tempered by high attack complexity - the dominant risk-limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker targeting a self-hosted TREK instance with OIDC configured crafts a manipulated OIDC callback or token payload that triggers the flawed `findOrCreateUser` logic, causing the server to associate the authentication session with a victim user account rather than the attacker's own identity. Given the high attack complexity rating, successful exploitation likely requires knowledge of valid account identifiers or the ability to manipulate specific OIDC claim fields recognized by the server. … |
| Remediation | Upgrade TREK to version 3.1.0, which resolves this vulnerability and 17 additional privately-reported security issues; the release is available at https://github.com/liketrek/TREK/releases/tag/v3.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in TREK collaborative travel planner (versions prior to 2.7.2) allows authenticated attackers with
Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authenticati
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthentica
Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server i
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-f
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate under
Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with fi
TREK collaborative travel planner versions before 2.7.2 serve uploaded user photos without authentication, allowing unau
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI red
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today