CVE-2025-68621

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68621", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-19T18:50:09.991Z", "datePublished": "2026-02-06T21:21:19.308Z", "dateUpdated": "2026-02-09T15:26:56.399Z"}, "containers": {"cna": {"title": "Trilium Notes has a Timing Attack Vulnerability in /api/login/sync", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x"}, {"name": "https://github.com/TriliumNext/Trilium/pull/8129", "tags": ["x_refsource_MISC"], "url": "https://github.com/TriliumNext/Trilium/pull/8129"}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"version": "< 0.101.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T21:21:19.308Z"}, "descriptions": [{"lang": "en", "value": "Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0."}], "source": {"advisory": "GHSA-hxf6-58cx-qq3x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:20:43.450115Z", "id": "CVE-2025-68621", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:26:56.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68621", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-09T15:20:43.450115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:20:44.278Z"}}], "cna": {"title": "Trilium Notes has a Timing Attack Vulnerability in /api/login/sync", "source": {"advisory": "GHSA-hxf6-58cx-qq3x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"status": "affected", "version": "< 0.101.0"}]}], "references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x", "name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TriliumNext/Trilium/pull/8129", "name": "https://github.com/TriliumNext/Trilium/pull/8129", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T21:21:19.308Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68621", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:26:56.399Z", "dateReserved": "2025-12-19T18:50:09.991Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T21:21:19.308Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Trilium", "vendor": "TriliumNext", "versions": [{"status": "affected", "version": "< 0.101.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:triliumnotes:trilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7F7FB8D-735B-494D-A4C9-C709F66BF7C4", "versionEndExcluding": "0.101.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0."}, {"lang": "es", "value": "Trilium Notes es una aplicaci\u00f3n jer\u00e1rquica para tomar notas de c\u00f3digo abierto y multiplataforma, con enfoque en la construcci\u00f3n de grandes bases de conocimiento personales. Antes de 0.101.0, una cr\u00edtica vulnerabilidad de ataque de temporizaci\u00f3n en el punto final de autenticaci\u00f3n de sincronizaci\u00f3n de Trilium permite a atacantes remotos no autenticados recuperar hashes de autenticaci\u00f3n HMAC byte a byte mediante an\u00e1lisis estad\u00edstico de temporizaci\u00f3n. Esto permite una omisi\u00f3n completa de autenticaci\u00f3n sin conocimiento de la contrase\u00f1a, otorgando acceso completo de lectura/escritura a la base de conocimiento de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en 0.101.0."}], "id": "CVE-2025-68621", "lastModified": "2026-06-17T09:59:21.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68621", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:20:43.450115Z", "version": "2.0.3"}}]}, "published": "2026-02-06T22:16:10.660", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/TriliumNext/Trilium/pull/8129"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-02-09T10:50:21.645075+00:00", "updated": "2026-02-09T10:50:21.645109+00:00", "vendors": ["triliumnext", "triliumnext$PRODUCT$trilium"]}