CVE-2026-78863

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78863", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-25T06:01:13.787Z", "datePublished": "2026-08-25T11:00:10.236Z", "dateUpdated": "2026-08-27T15:06:04.339Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-25T11:00:10.236Z"}, "title": "liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "liketrek", "product": "TREK", "versions": [{"version": "3.0.0", "status": "affected"}, {"version": "3.0.1", "status": "affected"}, {"version": "3.0.2", "status": "affected"}, {"version": "3.0.3", "status": "affected"}, {"version": "3.0.4", "status": "affected"}, {"version": "3.0.5", "status": "affected"}, {"version": "3.0.6", "status": "affected"}, {"version": "3.0.7", "status": "affected"}, {"version": "3.0.8", "status": "affected"}, {"version": "3.0.9", "status": "affected"}, {"version": "3.0.10", "status": "affected"}, {"version": "3.0.11", "status": "affected"}, {"version": "3.0.12", "status": "affected"}, {"version": "3.0.13", "status": "affected"}, {"version": "3.0.14", "status": "affected"}, {"version": "3.0.15", "status": "affected"}, {"version": "3.0.16", "status": "affected"}, {"version": "3.0.17", "status": "affected"}, {"version": "3.0.18", "status": "affected"}, {"version": "3.0.19", "status": "affected"}, {"version": "3.0.20", "status": "affected"}, {"version": "3.0.21", "status": "affected"}, {"version": "3.0.22", "status": "affected"}, {"version": "3.1.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:liketrek:trek:*:*:*:*:*:*:*:*"], "modules": ["Pre-2FA mfa_token Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-25T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-25T08:06:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ByteJMP (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/394939", "name": "VDB-394939 | liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394939/cti", "name": "VDB-394939 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78863", "name": "CVE-2026-78863 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/886929", "name": "Submit #886929 | mauriceboe TREK <= 3.0.22 Improper Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm", "tags": ["related"]}, {"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T15:05:53.392339Z", "id": "CVE-2026-78863", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:06:04.339Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication", "credits": [{"lang": "en", "type": "reporter", "value": "ByteJMP (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:liketrek:trek:*:*:*:*:*:*:*:*"], "vendor": "liketrek", "modules": ["Pre-2FA mfa_token Handler"], "product": "TREK", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.0.6"}, {"status": "affected", "version": "3.0.7"}, {"status": "affected", "version": "3.0.8"}, {"status": "affected", "version": "3.0.9"}, {"status": "affected", "version": "3.0.10"}, {"status": "affected", "version": "3.0.11"}, {"status": "affected", "version": "3.0.12"}, {"status": "affected", "version": "3.0.13"}, {"status": "affected", "version": "3.0.14"}, {"status": "affected", "version": "3.0.15"}, {"status": "affected", "version": "3.0.16"}, {"status": "affected", "version": "3.0.17"}, {"status": "affected", "version": "3.0.18"}, {"status": "affected", "version": "3.0.19"}, {"status": "affected", "version": "3.0.20"}, {"status": "affected", "version": "3.0.21"}, {"status": "affected", "version": "3.0.22"}, {"status": "unaffected", "version": "3.1.0"}]}], "timeline": [{"lang": "en", "time": "2026-08-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-25T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-25T08:06:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/394939", "name": "VDB-394939 | liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394939/cti", "name": "VDB-394939 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78863", "name": "CVE-2026-78863 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/886929", "name": "Submit #886929 | mauriceboe TREK <= 3.0.22 Improper Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm", "tags": ["related"]}, {"url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-25T11:00:10.236Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T15:05:53.392339Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-27T15:05:58.764Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-78863", "state": "PUBLISHED", "dateUpdated": "2026-08-25T11:00:10.236Z", "dateReserved": "2026-08-25T06:01:13.787Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-25T11:00:10.236Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:liketrek:trek:*:*:*:*:*:*:*:*"], "modules": ["Pre-2FA mfa_token Handler"], "product": "TREK", "vendor": "liketrek", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.0.6"}, {"status": "affected", "version": "3.0.7"}, {"status": "affected", "version": "3.0.8"}, {"status": "affected", "version": "3.0.9"}, {"status": "affected", "version": "3.0.10"}, {"status": "affected", "version": "3.0.11"}, {"status": "affected", "version": "3.0.12"}, {"status": "affected", "version": "3.0.13"}, {"status": "affected", "version": "3.0.14"}, {"status": "affected", "version": "3.0.15"}, {"status": "affected", "version": "3.0.16"}, {"status": "affected", "version": "3.0.17"}, {"status": "affected", "version": "3.0.18"}, {"status": "affected", "version": "3.0.19"}, {"status": "affected", "version": "3.0.20"}, {"status": "affected", "version": "3.0.21"}, {"status": "affected", "version": "3.0.22"}, {"status": "unaffected", "version": "3.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en liketrek TREK hasta 3.0.22. Se ve afectada la funci\u00f3n loginUser del archivo server/src/services/authService.ts del componente Gestor de mfa_token Pre-2FA. La manipulaci\u00f3n resulta en una autenticaci\u00f3n indebida. El ataque puede realizarse de forma remota. Se recomienda actualizar a la versi\u00f3n 3.1.0 para solucionar este problema. Se recomienda actualizar el componente afectado."}], "id": "CVE-2026-78863", "lastModified": "2026-09-28T23:10:00.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78863", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T15:05:53.392339Z", "version": "2.0.3"}}]}, "published": "2026-08-25T11:16:54.627", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/liketrek/TREK/releases/tag/v3.1.0"}, {"source": "cna@vuldb.com", "url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-78863"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/886929"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394939"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394939/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.22"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.1.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "TREK", "source": "cna", "vendor": "liketrek"}, "product": "trek", "vendor": "liketrek"}], "created": "2026-08-25T13:00:14.359910+00:00", "updated": "2026-08-25T16:15:05.193090+00:00", "vendors": ["liketrek", "liketrek$PRODUCT$trek"]}