CVE-2026-78863
Received Received - Intake

Improper Authentication in liketrek TREK Pre-2FA Handler

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulDB

Description
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78863
EUVD
EUVD-2026-65468

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
liketrek trek 3.1.0
liketrek trek to 3.0.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78863 is a critical authentication bypass in the TREK npm package (versions <= 3.0.22). It allows attackers to bypass Multi-Factor Authentication (MFA) by exploiting a JWT purpose confusion flaw. During login, a purpose-scoped JWT token (mfa_token) is issued after password verification but before TOTP validation. The session verifier fails to check the token's purpose claim, accepting the mfa_token as a valid session token across all authenticated endpoints. This enables attackers with a victim's password to gain full account access without completing the second factor authentication.

Detection Guidance

Detecting this vulnerability requires checking if your TREK instance is running a vulnerable version (<=3.0.22). Inspect the version of the TREK package in your environment using commands like 'npm list trek' or 'grep version package.json' in your project directory. Additionally, review authentication logs for unusual MFA bypass attempts or JWT tokens with purpose claims being accepted prematurely.

Impact Analysis

Attackers can bypass MFA and gain full account access using only a victim's password. This affects all MFA-enabled users with the default password_version (0). The vulnerability allows high confidentiality and integrity loss, enabling unauthorized data access, modification, or deletion. The impact is severe as it undermines the primary security layer of MFA.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires appropriate technical measures to ensure data confidentiality and integrity. HIPAA mandates strict access controls for protected health information. Bypassing MFA could lead to unauthorized access, resulting in non-compliance, potential data breaches, and associated legal penalties.

Mitigation Strategies

Immediately upgrade to TREK version 3.1.0 or later, as this vulnerability is addressed in that release. If upgrading is not immediately possible, disable MFA temporarily or restrict access to sensitive endpoints until the upgrade is completed. Review and rotate all credentials, especially for accounts with MFA enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart