CVE-2026-85638 Details

An authorization bypass vulnerability has been identified in Jofpin Trape version 2.0. The issue resides in the victim telemetry endpoints of the file core/user.py. The vulnerability allows for remote exploitation by manipulating the victim identifier (vId/id) in the POST request body. This exploitation can lead to unauthorized modifications of victim data, such as geolocation, online status, and captured form information. The vulnerability has been publicly disclosed and is available for exploitation.

It is recommended to issue each victim client a signed, server-generated session token upon registration, and to require this token for all subsequent write operations. Additionally, validate that the token corresponds to the vId being updated before making any database changes.