Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-45410— Time-based user enumeration in TREK authentication endpoint

Quick assessment

Affected
mauriceboe TREK
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TREK是Maurice个人开发者的一个自托管、实时协作的旅行规划工具，支持地图、预算和行程管理。 TREK 3.0.18之前版本存在安全漏洞，该漏洞源于登录流程中用户缺失时早期返回，攻击者可通过响应时间差异枚举有效用户账户，存在邮箱时执行bcrypt密码比较增加约370毫秒延迟，不存在时立即返回约10毫秒。

CVSS 5.3 · Medium EPSS 0.34% · P26

Affected Version Matrix 1

VendorProduct Version RangeStatus
mauriceboe TREK < 3.0.18 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45410

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Time-based user enumeration in TREK authentication endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过差异性导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
TREK 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TREK是Maurice个人开发者的一个自托管、实时协作的旅行规划工具，支持地图、预算和行程管理。 TREK 3.0.18之前版本存在安全漏洞，该漏洞源于登录流程中用户缺失时早期返回，攻击者可通过响应时间差异枚举有效用户账户，存在邮箱时执行bcrypt密码比较增加约370毫秒延迟，不存在时立即返回约10毫秒。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mauriceboe TREK < 3.0.18 -

II. Public POCs for CVE-2026-45410

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-45410

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-45410 (1)

Proof of Concept for CVE-2026-45410 (1)

IV. Related Vulnerabilities

Same product: TREK
Same vendor: mauriceboe
Same weakness: CWE-203

V. Comments for CVE-2026-45410

No comments yet

Leave a comment