CVE-2026-78863: liketrek TREK Auth Bypass Vulnerability

CVE-2026-78863 Overview

CVE-2026-78863 is an improper authentication vulnerability [CWE-287] affecting liketrek TREK versions up to 3.0.22. The flaw resides in the loginUser function within server/src/services/authService.ts, specifically in the Pre-2FA mfa_token handler. An attacker can manipulate the pre-2FA token flow to bypass authentication controls remotely without user interaction. The vendor addressed the issue in TREK version 3.1.0.

Critical Impact
Remote attackers with low privileges can bypass multi-factor authentication logic in TREK, compromising confidentiality, integrity, and availability of authenticated sessions.

Affected Products

liketrek TREK versions up to and including 3.0.22
Component: Pre-2FA mfa_token Handler
File: server/src/services/authService.ts (loginUser function)

Discovery Timeline

2026-08-25 - CVE-2026-78863 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78863

Vulnerability Analysis

The vulnerability affects the authentication workflow in TREK, an application whose server component is implemented in TypeScript. The loginUser function in server/src/services/authService.ts handles the pre-two-factor authentication (2FA) stage, issuing an mfa_token that the client subsequently presents to complete the 2FA challenge.

According to the GitHub Security Advisory GHSA-mjh4-w6fq-54qm, manipulation of this handler results in improper authentication. The consequence is that an attacker holding low-privileged credentials can influence the 2FA flow in a way that undermines the intended authentication guarantees.

Because the flaw sits between the primary credential check and the second factor, exploitation converts a partially authenticated state into a fully authenticated one without completing the required 2FA verification.

Root Cause

The root cause is improper authentication [CWE-287] within the Pre-2FA mfa_token handler. The loginUser function does not sufficiently validate the state, binding, or lifecycle of the mfa_token before treating a session as authenticated. This weakness allows the token to be reused, forged, or trusted in contexts where 2FA has not been completed.

Attack Vector

Exploitation occurs over the network against the TREK authentication endpoint. An attacker interacts with the login flow, obtains or manipulates the pre-2FA mfa_token, and submits crafted requests to the authentication service. Refer to the VulDB entry for CVE-2026-78863 and the GitHub advisory for further technical context. No verified proof-of-concept code has been published at the time of writing.

Detection Methods for CVE-2026-78863

Indicators of Compromise

Authentication events where a user completes login without a corresponding successful 2FA challenge event.
Repeated requests to the TREK login endpoint referencing the same mfa_token value from different sessions or IP addresses.
Unusual reuse or replay of mfa_token values against server/src/services/authService.ts endpoints.

Detection Strategies

Instrument the loginUser function and 2FA verification endpoint to log token issuance, consumption, and validation outcomes with correlation identifiers.
Alert on session establishment where the pre-2FA token was issued but the 2FA success event is missing, out of order, or from a different client fingerprint.
Compare TREK server logs against reverse proxy or web application firewall (WAF) logs to identify anomalous authentication sequences.

Monitoring Recommendations

Monitor for authentication anomalies such as impossible travel, rapid token reuse, and privilege changes immediately after login.
Track the TREK version deployed in each environment and flag any host running a release earlier than 3.1.0.
Retain authentication and 2FA telemetry for a period sufficient to support retrospective hunting once patches are applied.

How to Mitigate CVE-2026-78863

Immediate Actions Required

Upgrade all TREK deployments to version 3.1.0 or later, as recommended in the TREK v3.1.0 release notes.
Inventory internal and internet-exposed TREK instances and prioritize patching those reachable from untrusted networks.
Invalidate existing mfa_token values and active sessions after upgrading to force re-authentication.

Patch Information

The vendor released liketrek TREK version 3.1.0 to remediate CVE-2026-78863. Administrators should apply the upgrade per the official release on GitHub and validate that the patched loginUser logic in server/src/services/authService.ts is in place after deployment.

Workarounds

Restrict network access to the TREK authentication endpoint using firewall or reverse proxy rules until the upgrade is applied.
Enforce short expiration times and single-use semantics for any pre-2FA tokens at the reverse proxy layer where feasible.
Require an additional out-of-band verification step for high-privilege accounts until version 3.1.0 is deployed.

bash

# Verify installed TREK version and upgrade to a fixed release
npm ls trek || cat package.json | grep -i trek
# Upgrade to the patched release
npm install trek@3.1.0