Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2025-68621Trilium Notes has a Timing Attack Vulnerability in /api/login/sync
High 7.4
In plain English
A high-severity security flaw in Trilium from TriliumNext. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TriliumNext | Trilium | < 0.101.0 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x x_refsource_CONFIRM
- https://github.com/TriliumNext/Trilium/pull/8129 x_refsource_MISC