CVE-2026-78863: liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-09-28
Weakness: CWE-287

Description

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended.

Affected products

liketrek TREK: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+17)

References

https://github.com/liketrek/TREK/releases/tag/v3.1.0
https://github.com/mauriceboe/TREK/security/advisories/GHSA-mjh4-w6fq-54qm
https://vuldb.com/cve/CVE-2026-78863
https://vuldb.com/submit/886929
https://vuldb.com/vuln/394939
https://vuldb.com/vuln/394939/cti

Get alerted when CVE-2026-78863 or the next vulnerability affects your stack