Executive brief
TREK, a collaborative travel planning application, is vulnerable to a flaw that allows outsiders to determine which email addresses are registered with the service. By measuring the time it takes for the login page to respond, an attacker can distinguish between valid and invalid accounts because the system processes real accounts more slowly. This information can be used to facilitate targeted phishing, password guessing attacks, or other unauthorized access attempts.
Technical details
A timing side-channel vulnerability exists in the POST /api/auth/login endpoint of TREK due to an observable timing discrepancy (CWE-208). The backend authentication handler returns an immediate response (~10ms) if a user email is not found in the database, but performs a computationally expensive bcrypt password comparison (~370ms) if the email exists. This ~14x difference in latency allows unauthenticated remote attackers to enumerate valid user accounts even when HTTP status codes and response bodies are identical (401 Unauthorized). The vulnerability is resolved in version 3.0.18 by ensuring consistent processing time regardless of user existence.
Affected products
- mauriceboe TREK < 3.0.18
Timeline
- 2026-05-10: other: PoC created by researcher
- 2026-05-11: advisory: Vendor security advisory published
- 2026-05-28: disclosed: CVE published to NVD
- 2026-05-28: patched: Fix released in version 3.0.18