CVE-2026-78863: falha de média gravidade em liketrek TREK
liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa_token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version 3.1.0 is recommended to address this issue. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
liketrek · TREKCVEs relacionadas — liketrek TREK
No mesmo produto, das mais perigosas para as menos.
CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2026-78886MEDIUMliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalEPSS 0.6%CVE-2026-78887MEDIUMliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationEPSS 0.5%CVE-2026-85738MEDIUMTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)EPSS 0.4%CVE-2026-78864MEDIUMliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionEPSS 0.3%