Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by VulDB

CVE-2026-78885liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication

Medium 5.6

In plain English

A medium-severity improper authentication in TREK from liketrek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.

Affected products (as reported)

VendorProductVersions
liketrek TREK 3.0.03.0.13.0.23.0.33.0.43.0.53.0.63.0.7

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References