PoC Index

CVE-2025-68621

HIGH 7.4EPSS 0.5%

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.

CVSS v3.1
7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
0.51% chance of exploitation in the next 30 days, 41th percentile
Published
2026-02-06
Updated
2026-02-09

Proof-of-concept exploits (1)

References

Related