CVE-2026-85636
MediumCVSS 5.3Summary
In jofpin trape 1.0.0, the core/stats.py file of the Login Endpoint component has a missing authentication vulnerability. The attack can be initiated remotely, and the exploit is publicly available. The project was informed but has not responded.
Risk Assessment
Missing authentication in the login endpoint may allow unauthorized users to access statistics or other data, potentially leading to confidentiality breaches.
Recommendation
Immediately restrict access to the Login Endpoint component, e.g., via firewall or VPN, and monitor logs for unauthorized access attempts. Also consider seeking an alternative solution or update if available.
Other vulnerabilities in jofpin trape
See all- CVE-2026-85638High
jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.
- CVE-2026-85637Medium
In jofpin trape 1.0.0/2.0, the join_room function in core/sockets.py of the Admin Endpoint component lacks authentication. The attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.