CVE-2026-85637
MediumCVSS 5.3Summary
In jofpin trape 1.0.0/2.0, the join_room function in core/sockets.py of the Admin Endpoint component lacks authentication. The attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.
Risk Assessment
Missing authentication in the admin endpoint may allow unauthorized users to access administrative functions, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately restrict access to the Admin Endpoint component, e.g., via firewall or VPN, and monitor logs for unauthorized access attempts. Also consider seeking an alternative solution or update if available.
Other vulnerabilities in jofpin trape
See all- CVE-2026-85638High
jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.
- CVE-2026-85636Medium
In jofpin trape 1.0.0, the core/stats.py file of the Login Endpoint component has a missing authentication vulnerability. The attack can be initiated remotely, and the exploit is publicly available. The project was informed but has not responded.
Original NVD description (English source)
A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.