TriliumNext Trilium up to 0.100.x Sync Authentication Endpoint timing discrepancy

Summaryinfo

A vulnerability was found in TriliumNext Trilium up to 0.100.x. It has been declared as problematic. The affected element is an unknown function of the component Sync Authentication Endpoint. Executing a manipulation can lead to timing discrepancy. This vulnerability is tracked as CVE-2025-68621. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in TriliumNext Trilium up to 0.100.x and classified as problematic. This vulnerability affects some unknown processing of the component Sync Authentication Endpoint. The manipulation with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality. CVE summarizes:

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-68621 since 12/19/2025. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 0.101.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-206876). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TriliumNext

Name

• Trilium

Version

• 0.100

Website

• Product: https://github.com/TriliumNext/Trilium/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion