{"id":"CVE-2025-68621","aliases":["EUVD-2025-206876","GHSA-hxf6-58cx-qq3x"],"status":"published","title":"Trilium Notes has a Timing Attack Vulnerability in /api/login/sync","description":"Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.  Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00565,"percentile":0.47364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-208"],"published":"2026-02-06T21:21:19Z","modified":"2026-10-28T02:30:35Z","exploits":[{"source":"pocgithub","id":"sivaadityacoder/CVE-2025-68621","title":"sivaadityacoder/CVE-2025-68621","date":"2026-04-25","url":"https://github.com/sivaadityacoder/CVE-2025-68621"}],"products":[{"vendor":"triliumnext","product":"trilium"},{"vendor":"triliumnotes","product":"trilium"}],"references":[{"url":"https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/TriliumNext/Trilium/pull/8129","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68621.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68621","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68621","title":"Trilium Notes has a Timing Attack Vulnerability in /api/login/sync","description":"Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.  Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.","status":"published","published":"2026-02-06T21:21:19.308Z","modified":"2026-02-09T15:26:56.399Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-206876","description":"Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.  Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.","status":"published","published":"2026-02-06T21:21:19Z","modified":"2026-02-09T15:26:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:42.465921Z"}],"nvd":[{"id":"CVE-2025-68621","description":"Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.  Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.","status":"published","published":"2026-02-06T22:16:10.66Z","modified":"2026-06-17T09:59:21.71Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"CVE-2025-68621","title":"Trilium Notes has a Timing Attack Vulnerability in /api/login/sync","description":"Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.  Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.","status":"published","published":"2026-02-06T21:21:19.308Z","modified":"2026-10-28T02:30:35.305704885Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}