Improper Authentication in liketrek TREK OIDC Service
CVE-2026-78885

6.3MEDIUM

Key Information:

Vendor

Liketrek

Status
Trek
Vendor
CVE Published:
25 August 2026

What is CVE-2026-78885?

The liketrek TREK up to version 3.0.22 is vulnerable due to an improper authentication flaw in the OIDC Service, specifically within the findOrCreateUser function located at server/src/services/oidcService.ts. This vulnerability allows remote attackers to manipulate authentication processes at a complex level, posing a risk to security. It is crucial for users to upgrade to version 3.1.0 or later to mitigate this issue and ensure the integrity of their authentication mechanisms.

Affected Version(s)

TREK 3.0.0

TREK 3.0.1

TREK 3.0.2

References

https://vuldb.com/vuln/394941
vdb-entrytechnical-description
https://vuldb.com/vuln/394941/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-78885
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ByteJMP (VulDB User)
.