EUVD-2026-65468

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...

CVE-2026-78863

liketrek TREK (versions up to 3.0.22 ) contains an improper authentication vulnerability in the Pre-2FA mfa_token Handler component, specifically in the loginUser function within server/src/services/authService.ts. A remote attacker with low privileges can exploit this flaw to achieve partial com...

CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...