CVE-2026-78885CWE-287

CVE-2026-78885

Medium · published August 25, 2026

CVSS v3.1
5.6
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00581 · 47.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-25T17:19Z
References (6)
https://github.com/liketrek/TREK/releases/tag/v3.1.0 · [email protected]https://github.com/mauriceboe/TREK/security/advisories/GHSA-fvgw-r58q-4cw4 · [email protected]https://vuldb.com/cve/CVE-2026-78885 · [email protected]https://vuldb.com/submit/886931 · [email protected]https://vuldb.com/vuln/394941 · [email protected]https://vuldb.com/vuln/394941/cti · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 12:15Z
    liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication
    cvelistv5