CVE-2026-45410— Time-based user enumeration in TREK authentication endpoint

Time-based user enumeration in TREK authentication endpoint

TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

通过差异性导致的信息暴露

TREK 安全漏洞

TREK是Maurice个人开发者的一个自托管、实时协作的旅行规划工具，支持地图、预算和行程管理。 TREK 3.0.18之前版本存在安全漏洞，该漏洞源于登录流程中用户缺失时早期返回，攻击者可通过响应时间差异枚举有效用户账户，存在邮箱时执行bcrypt密码比较增加约370毫秒延迟，不存在时立即返回约10毫秒。

N/A

N/A