Timing Attack Vulnerability in Trilium Notes by Trilium

CVE-2025-68621

What is CVE-2025-68621?

Trilium Notes, an open-source hierarchical note-taking application, is affected by a vulnerability that could allow unauthenticated remote attackers to exploit a timing attack on its sync authentication endpoint. This flaw enables a potential attacker to recover HMAC authentication hashes through a methodical statistical timing analysis, thereby circumventing authentication mechanisms entirely. As a result, attackers may obtain full read/write privileges to a victim's knowledge base without any knowledge of their password. This issue has been addressed in version 0.101.0.

References