Is CVE-2026-78863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78863 being exploited in the wild.

How severe is CVE-2026-78863?

Medium severity, with a CVSS score of 6.3, published 25 August 2026.

Is there a fix for CVE-2026-78863?

A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78863 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78863?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78863: liketrek TREK MFA bypass in pre-2FA token validation

CVE-2026-78863 · Severity: medium · CVSS 6.3 · Published 2026-08-25

TREK is a travel-planning and expense-sharing application used for organizing group trips. The vulnerability allows attackers who know a user's password to completely bypass multi-factor authentication (MFA) and gain full access to any account by reusing a temporary authentication token that should only be valid for the MFA entry step. This means two-factor authentication offers no protection against credential theft or phishing attacks.

Quick answers

Is CVE-2026-78863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78863 being exploited in the wild.
How severe is CVE-2026-78863?: Medium severity, with a CVSS score of 6.3, published 25 August 2026.
Which products and versions are affected?: liketrek TREK up to 3.0.22.
Is there a fix for CVE-2026-78863?: A patch was published on 2026-06-16: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78863 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78863?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a JWT purpose confusion flaw in the pre-MFA authentication flow. The loginUser function in server/src/services/authService.ts issues a purpose-scoped mfa_token JWT after password verification, but the central session verifier (verifyJwtAndLoadUser in server/src/middleware/auth.ts) never validates the JWT purpose claim—it accepts any token with a matching user ID as a full session token regardless of its intended scope. An attacker with the victim's password calls POST /api/auth/login, receives the mfa_token, and replays it as a Bearer token on authenticated endpoints to bypass the TOTP/backup code check entirely. The flaw affects all users with MFA enabled and default password_version=0. Patch available in version 3.1.0; fix rejects tokens with a purpose claim and binds password_version into the mfa_token for defense-in-depth.

Affected products

liketrek TREK up to 3.0.22

Timeline

2026-06: disclosed: Reported via coordinated private disclosure
2026-06-16: patched: Fixed in version 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.