CVE-2026-78885: liketrek TREK OIDC Authentication Bypass Flaw

CVE-2026-78885 Overview

CVE-2026-78885 is an improper authentication vulnerability [CWE-287] in the liketrek TREK application affecting versions up to 3.0.22. The flaw resides in the findOrCreateUser function within server/src/services/oidcService.ts, part of the OpenID Connect (OIDC) Service component. An attacker can exploit the weakness remotely over the network without authentication, though the attack requires a high level of complexity. The vendor addressed the issue in TREK version 3.1.0.

Critical Impact
Successful exploitation can lead to improper authentication decisions in the OIDC service, potentially allowing unauthorized account access or user impersonation within the TREK application.

Affected Products

liketrek TREK versions up to and including 3.0.22
Component: OIDC Service (server/src/services/oidcService.ts)
Fixed in: liketrek TREK version 3.1.0

Discovery Timeline

2026-08-25 - CVE-2026-78885 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78885

Vulnerability Analysis

The vulnerability affects the findOrCreateUser function in the TREK OIDC Service. This function handles account provisioning and lookup during OpenID Connect authentication flows. Improper authentication handling in this code path can allow an attacker to influence how the service maps external OIDC identities to internal user accounts. The result is an authentication decision that does not correctly validate the caller.

The issue is remotely reachable because OIDC endpoints are exposed over the network. Exploitation complexity is described as high, meaning an attacker needs specific conditions or prerequisites to trigger the flaw reliably. No public proof-of-concept exploit or evidence of exploitation in the wild has been published.

Root Cause

The root cause is improper authentication logic within findOrCreateUser. According to the GitHub Security Advisory GHSA-fvgw-r58q-4cw4, the function does not enforce sufficient checks when reconciling OIDC identity claims with existing user records. This weakness maps to CWE-287 (Improper Authentication), where the software claims to verify a user's identity but does not do so correctly.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker interacts with the OIDC authentication flow using crafted claims or account identifiers to influence how findOrCreateUser resolves the user record. Because the vulnerability is authentication-related, a successful attacker could gain access to an account they are not entitled to use, subverting the intended identity federation model.

No verified exploit code is publicly available. Technical details are documented in the VulDB entry for CVE-2026-78885 and the vendor's advisory.

Detection Methods for CVE-2026-78885

Indicators of Compromise

Unexpected creation of new user accounts in TREK immediately following OIDC login attempts from unfamiliar identity providers or subjects.
OIDC callbacks containing subject (sub) or email claims that conflict with previously observed values for the same user.
Successful authentications where the OIDC issuer, audience, or subject claim does not match the configured trust chain.

Detection Strategies

Audit the TREK application logs for calls into findOrCreateUser where an existing user is matched by non-primary claims such as email rather than sub.
Correlate OIDC token exchange events with account linkage or creation events, and alert when the two occur outside expected flows.
Compare the version of deployed TREK instances against 3.1.0 using software inventory or SBOM data to identify vulnerable hosts.

Monitoring Recommendations

Enable verbose logging on the TREK OIDC service and forward authentication events to a centralized logging or SIEM platform.
Monitor for anomalous session establishment patterns, such as a single external identity binding to multiple internal accounts.
Track HTTP requests to OIDC callback endpoints for repeated failures followed by a successful authentication, which may indicate probing.

How to Mitigate CVE-2026-78885

Immediate Actions Required

Upgrade TREK to version 3.1.0 or later using the official v3.1.0 release.
Inventory all TREK deployments and identify instances running versions up to 3.0.22.
Review OIDC provider configuration and confirm that only trusted issuers and audiences are accepted.

Patch Information

The vendor has released liketrek TREK version 3.1.0, which resolves the improper authentication flaw in findOrCreateUser. Upgrading the affected component is the recommended remediation. Refer to the TREK v3.1.0 release notes and the GHSA-fvgw-r58q-4cw4 advisory for details on the fix.

Workarounds

Restrict network exposure of the TREK OIDC endpoints to trusted networks or through a reverse proxy with additional authentication checks until the patch can be applied.
Temporarily disable automatic user provisioning via OIDC and require administrator approval for new account creation.
Rotate any tokens or session credentials issued during periods when a vulnerable version was exposed to untrusted networks.

bash

# Verify installed TREK version and upgrade to the fixed release
git -C /opt/TREK describe --tags
git -C /opt/TREK fetch --tags
git -C /opt/TREK checkout v3.1.0
npm ci && npm run build