« Volver al listado

CVE-2026-45410

Estado: AplazadaMedia (5.3)—

TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mauriceboe — TrekAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45410",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45410",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-29T14:46:27.011976Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mauriceboe",
          "product": "TREK",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.18"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-28T22:17:01.050",
  "references": [
    {
      "url": "https://gist.github.com/jubnl/c2402adf85d946c1730867aeecc794de",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mauriceboe/TREK/security/advisories/GHSA-3552-3c98-x79r",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        },
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18."
    },
    {
      "lang": "es",
      "value": "TREK es un planificador de viajes colaborativo. Antes de la versión 3.0.18, un retorno temprano por usuario inexistente durante el flujo de inicio de sesión permitió a un atacante enumerar cuentas de usuario válidas a través de una discrepancia en el tiempo de respuesta. Cuando una dirección de correo electrónico existía en la base de datos, el backend realizaba una comparación de contraseña bcrypt antes de devolver un 401 No autorizado, añadiendo ~370 ms de latencia. Cuando el correo electrónico no existía, el backend devolvía inmediatamente (~10 ms). Esta diferencia de tiempo de ~14× podía detectarse sin ninguna diferencia en los códigos de estado HTTP o los cuerpos de respuesta. Esta vulnerabilidad está corregida en la versión 3.0.18."
    }
  ],
  "lastModified": "2026-07-21T10:10:00.103",
  "sourceIdentifier": "security-advisories@github.com"
}