CVE-2026-45410 Details

A timing-based user enumeration vulnerability has been identified in TREK, a collaborative travel planner, in versions prior to 3.0.18. The issue arises during the login process, where an early return on missing users allows attackers to differentiate between valid and invalid email addresses based on response times. When a valid email is used, the server adds approximately 370 milliseconds of delay after performing a bcrypt password comparison before returning a 401 Unauthorized status. In contrast, requests with non-existent emails are processed almost immediately, creating a consistent timing discrepancy of about 14 times that can be exploited without any visible differences in HTTP status codes or response bodies.

Users are advised to update TREK to version 3.0.18 or later, where this vulnerability has been fixed.