CVE-2025-68621
Triliumnotes Trilium ≤ 0.101.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2025-68621 is a high-severity Observable Timing Discrepancy (CWE-208) vulnerability in Triliumnotes Trilium. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Trilium Notes, an open-source cross-platform hierarchical note-taking application designed for building large personal knowledge bases, is affected by CVE-2025-68621. This critical timing attack vulnerability, classified under CWE-208 (Observable Timing Discrepancy), exists in the sync authentication endpoint in versions prior to 0.101.0. It enables attackers to recover HMAC authentication hashes byte-by-byte via statistical timing analysis, with a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Unauthenticated remote attackers can exploit this vulnerability over the network by sending crafted authentication requests and measuring response times with high precision. Through repeated statistical analysis, they can reconstruct the full HMAC hash without knowing the password, achieving complete authentication bypass. Successful exploitation grants full read/write access to the victim's knowledge base.
The vulnerability is addressed in Trilium Notes version 0.101.0. Security practitioners should upgrade to this version immediately. Additional mitigation details are available in the GitHub security advisory at https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hxf6-58cx-qq3x and the fixing pull request at https://github.com/TriliumNext/Trilium/pull/8129.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206876
Vulnerability Data
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes…
more
byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.2.4
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can include timing analysis or side-channel test cases that reveal observable timing discrepancies.
Engineering principles can mandate constant-time algorithms and side-channel resistance so timing discrepancies are never introduced.
Requiring approved cryptographic modules and algorithms implicitly demands implementations free of observable timing leaks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.