jofpin trape vulnerabilities

jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.

In jofpin trape 1.0.0/2.0, the join_room function in core/sockets.py of the Admin Endpoint component lacks authentication. The attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.

In jofpin trape 1.0.0, the core/stats.py file of the Login Endpoint component has a missing authentication vulnerability. The attack can be initiated remotely, and the exploit is publicly available. The project was informed but has not responded.