CVE-2025-68621 - CVE House
Back to Database
Status published High CVE-2025-68621

Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

Vulnerability Description

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68621

Credits & Attribution

No credits recorded in the NVD database.

References

More from TriliumNext

View All →
CVE-2025-53544
Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval
High 7.5

Affected Vendor

TriliumNext

View all reports →

Affected Software

Trilium
Vulnerable Versions:
< 0.101.0

Timeline

Official Publish: February 6th, 2026
Last Modified: February 9th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-208

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.