The vulnerability arises from an authentication flaw in the findOrCreateUser function of the OIDC Service. This flaw allows an attacker to bypass standard authentication checks and create or access user sessions without valid credentials, potentially granting unauthorized access to protected resources. The weakness is categorized as an authentication failure (CWE‑287). The attack is possible remotely and is described as having a high level of complexity, but the exploitation path remains viable for skilled adversaries.

The issue affects the liketrek TREK product up to version 3.0.22. Any installations of TREK using those versions are vulnerable. The vendor has released version 3.1.0 with the fix, and upgrading to that version or later resolves the problem.

The CVSS score of 6.3 indicates a medium severity authentication vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits yet. The described attack requires remote interaction and is considered difficult to execute, but the potential impact of unauthorized access warrants prompt remediation. The likely attack vector is through the OIDC Service’s findOrCreateUser endpoint, where the authentication check is improperly validated.