CVE-2025-53544: TriliumNext Trilium · Improper Restriction of Excessive Authentication Attempts
Affects TriliumNext TriliumSource CVE Database V5
Not known to be exploited · CVSS 7.5 High : upgrade to 0.97.0 soon.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.97.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade TriliumNext Trilium to 0.97.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| TriliumNext Trilium | Affected
| Fixed in
|
AI-suggested
- Immediate upgrade to Trilium version 0.97.0 or later, where the brute-force protection bypass is fixed, is the most effective mitigation.
- If upgrading is not immediately possible, restrict network exposure of Trilium instances by limiting access to trusted IP addresses or VPNs to reduce the attack surface.
- Implement external rate limiting or web application firewall (WAF) rules to detect and block excessive authentication attempts targeting the initial sync seed retrieval endpoint.
- Monitor application logs for repeated failed password attempts and set up alerts for suspicious activity indicative of brute-force attacks.
- Encourage users to use strong, complex passwords and enable multi-factor authentication (MFA) where supported to add an additional layer of security.
- Conduct regular security audits and penetration testing on exposed Trilium deployments to identify and remediate any residual weaknesses.
- Educate users about the risks of exposing personal knowledge bases to the internet and best practices for secure deployment.
Description
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0.