The vulnerability lies in the loginUser function of the server/src/services/authService.ts component, where the pre‑2FA mfa_token handling fails to correctly validate authentication. This flaw enables an attacker to bypass authentication checks, potentially gaining unauthorized access to the TREK application. The weakness is identified as CWE‑287 and results in a remote authentication bypass without any additional prerequisites beyond reaching the exposed endpoint.

liketrek TREK versions up to 3.0.22 are affected. The functionality is part of the mfa_token handler that supports a pre‑2FA authentication flow. Users running these releases should upgrade to version 3.1.0 or later, which contains the security fix for the improper authentication bug.

The CVSS score of 5.3 indicates a medium severity issue, and the EPSS score is not available. The vulnerability can be exploited from a remote location by targeting the authentication endpoint, meaning that systems exposed to the internet are at risk. Although it is not listed in the CISA KEV catalog, the remote nature of the attack and the lack of additional mitigations suggest that the risk to exposed installations is significant enough to warrant prompt remediation.