A critical brute-force protection bypass in Trilium versions prior to 0.97.0 allows unauthenticated attackers to conduct credential stuffing or brute-force attacks against user accounts.

This vulnerability is an improper restriction of excessive authentication attempts (CWE-307) located in the initial sync seed retrieval endpoint. It allows an unauthenticated attacker to bypass rate limiting mechanisms, significantly increasing the probability of successfully guessing a user password.

The ability to bypass brute-force protection poses a severe threat to the confidentiality of sensitive data stored within personal knowledge bases. Given that Trilium often stores highly sensitive documentation, successful unauthorized access could lead to significant data exfiltration, reputational harm, and the compromise of intellectual property. The CVSS score of 7.5 reflects the high risk associated with remote, unauthenticated exploitation.

Immediate Action: Upgrade to Trilium version 0.97.0 or later to apply the necessary rate-limiting patches.

Proactive Monitoring: Review web access logs for anomalous spikes in traffic directed toward the initial sync seed retrieval endpoint, which may indicate automated brute-force attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or implement additional network-level rate limiting to block high-frequency requests from single IP addresses until the patch is applied.

Public Exploit Available: Unknown.

This vulnerability presents a clear and actionable risk to any instance of Trilium exposed to the internet. Administrators must prioritize updating to version 0.97.0 immediately to restore effective brute-force protection. Failure to patch leaves the instance vulnerable to automated credential guessing, which could result in a total compromise of the knowledge base.