The vulnerability in mauriceboe TREK (before version 3.0.18) arises from an observable timing discrepancy during the login process. When a login attempt uses an email address present in the system, the backend performs a bcrypt password hash comparison, causing a delay of roughly 370 milliseconds before returning a 401 Unauthorized response. If the email does not exist, the response is returned immediately (~10 milliseconds). This 14-fold timing difference can be detected by an attacker to enumerate valid user accounts without any difference in HTTP status codes or response content. The issue is classified under CWE-203 (Observable Discrepancy) and CWE-208 (Information Exposure Through an Error Message). The vulnerability is addressed in TREK version 3.0.18.

An attacker can leverage the timing discrepancy to enumerate valid user accounts on affected TREK instances. This information disclosure can facilitate targeted attacks such as phishing or brute force attempts. There is no direct impact on confidentiality of passwords or system integrity reported, and no known exploits in the wild at this time.

This vulnerability is fixed in TREK version 3.0.18. Users should upgrade to version 3.0.18 or later to eliminate the timing discrepancy. Since no official remediation level is provided beyond the fix, patching is the recommended action. There is no indication that temporary mitigations or no-action advisories apply.