CVE-2026-45410 Time-based user enumeration in TREK authentication endpoint
Attackers can enumerate valid user accounts in TREK by measuring response time differences during login attempts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45410?
CVE-2026-45410 is a medium-severity vulnerability in mauriceboe TREK, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an email address existed in the database, the backend performed a bcrypt password comparison before returning a 401 Unauthorized, adding ~370 ms of latency. When the email did not exist, the backend returned immediately (~10 ms). This ~14× timing difference could be detected without any difference in HTTP status codes or response bodies. This vulnerability is fixed in 3.0.18.
Which versions are affected by CVE-2026-45410?
How do I fix CVE-2026-45410?
No fix has been published for CVE-2026-45410 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45410 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45410 exists.
Sources
Also known as GHSA-3552-3c98-x79r.