User Enumeration Vulnerability in TREK by Maurice Boe

CVE-2026-45410

What is CVE-2026-45410?

TREK, a collaborative travel planner, is susceptible to a user enumeration vulnerability due to unequal response times during the login process. Prior to version 3.0.18, when a user attempted to log in with an email address that existed in the database, the system engaged in a bcrypt password verification, introducing a latency of approximately 370 milliseconds. Conversely, if the email did not exist, the response was returned almost instantaneously at about 10 milliseconds. This significant difference in response times, without varying HTTP status codes or bodies, could potentially allow an attacker to determine valid user accounts merely by measuring the login response durations. The issue has been addressed in version 3.0.18.

References