CVE-2025-68621— Trilium Notes has a Timing Attack Vulnerability in /api/login/sync
Quick assessment
Affected
TriliumNext Trilium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Trilium Notes是Zadam个人开发者的一个分层笔记应用程序。专注于构建大型个人知识库。 Trilium Notes 0.101.0之前版本存在安全漏洞，该漏洞源于同步身份验证端点存在关键时序攻击，可能导致未经验证的远程攻击者通过统计时序分析逐字节恢复HMAC身份验证哈希，从而完全绕过身份验证。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-68621
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Trilium Notes has a Timing Attack Vulnerability in /api/login/sync
Source: CVE Program / CVE List V5
Vulnerability Description
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Trilium Notes 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Trilium Notes是Zadam个人开发者的一个分层笔记应用程序。专注于构建大型个人知识库。 Trilium Notes 0.101.0之前版本存在安全漏洞，该漏洞源于同步身份验证端点存在关键时序攻击，可能导致未经验证的远程攻击者通过统计时序分析逐字节恢复HMAC身份验证哈希，从而完全绕过身份验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TriliumNext | Trilium | < 0.101.0 | - |
|
II. Public POCs for CVE-2025-68621
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68621
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Trilium
-
CVE-2026-77438
Trilium unauthenticated share-search discloses password-prot -
CVE-2026-53580
Trilium arbitrary file read and denial of service via file:/ -
CVE-2026-53579
Trilium: Note Import to RCE via Book Note -
CVE-2026-53578
Trilium: Note Import to RCE via Mind Elixir dangerouslySetIn -
CVE-2026-48996
Trilium: Malicious import with GeoMap marker title XSS leads
Same vendor: TriliumNext
-
CVE-2026-77438
Trilium unauthenticated share-search discloses password-prot -
CVE-2026-53580
Trilium arbitrary file read and denial of service via file:/ -
CVE-2026-53579
Trilium: Note Import to RCE via Book Note -
CVE-2026-53578
Trilium: Note Import to RCE via Mind Elixir dangerouslySetIn -
CVE-2026-48996
Trilium: Malicious import with GeoMap marker title XSS leads
Same weakness: CWE-208
-
CVE-2026-107269
Gophish through 0.12.1 Username Enumeration via POST /login -
CVE-2026-18040
HQC leaks private key information through secret-indexed GF( -
CVE-2026-18036
NTRU leaks private key information by reducing secret values -
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-54875
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RIS
V. Comments for CVE-2025-68621
No comments yet