CVE-2026-78863

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78863
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78863.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78863
Aliases
  • GHSA-mjh4-w6fq-54qm
Published
2026-08-25T11:00:10Z
Modified
2026-08-28T03:30:58Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
Details

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78863.json"
}
References

Affected packages

Git / github.com/liketrek/trek

Affected ranges

Type
GIT
Repo
https://github.com/liketrek/trek
Events
Introduced
523bca3a20595083f6d78b0de7c338fc208464d5
Fixed
f6af1d67a2630d77dcce39a92ac5599d08d7a5a1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "3.0.6"
        },
        {
            "last_affected": "3.0.6"
        },
        {
            "introduced": "3.0.7"
        },
        {
            "last_affected": "3.0.7"
        },
        {
            "introduced": "3.0.8"
        },
        {
            "last_affected": "3.0.8"
        },
        {
            "introduced": "3.0.9"
        },
        {
            "last_affected": "3.0.9"
        },
        {
            "introduced": "3.0.10"
        },
        {
            "last_affected": "3.0.10"
        },
        {
            "introduced": "3.0.11"
        },
        {
            "last_affected": "3.0.11"
        },
        {
            "introduced": "3.0.12"
        },
        {
            "last_affected": "3.0.12"
        },
        {
            "introduced": "3.0.13"
        },
        {
            "last_affected": "3.0.13"
        },
        {
            "introduced": "3.0.14"
        },
        {
            "last_affected": "3.0.14"
        },
        {
            "introduced": "3.0.15"
        },
        {
            "last_affected": "3.0.15"
        },
        {
            "introduced": "3.0.16"
        },
        {
            "last_affected": "3.0.16"
        },
        {
            "introduced": "3.0.17"
        },
        {
            "last_affected": "3.0.17"
        },
        {
            "introduced": "3.0.18"
        },
        {
            "last_affected": "3.0.18"
        },
        {
            "introduced": "3.0.19"
        },
        {
            "last_affected": "3.0.19"
        },
        {
            "introduced": "3.0.20"
        },
        {
            "last_affected": "3.0.20"
        },
        {
            "introduced": "3.0.21"
        },
        {
            "last_affected": "3.0.21"
        },
        {
            "introduced": "3.0.22"
        },
        {
            "last_affected": "3.0.22"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.2
3.0.20
3.0.21
3.0.22
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
v3.*
v3.0.0
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.17
v3.0.18
v3.0.19
v3.0.2
v3.0.20
v3.0.21
v3.0.22
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78863.json"