CVE-2026-85639 Details
Description
A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A race condition vulnerability has been identified in Jofpin Trape version 2.0, specifically within the Telemetry Endpoint component. The issue arises in the 'core/user.py' file, where the 'vId' argument can be manipulated, leading to concurrent requests being processed in an unintended manner. This vulnerability can be exploited remotely, although such attacks are considered highly complex. The project has been made aware of this issue, but no response has been received yet.
It is recommended to wrap the registration process in a transaction to ensure atomicity, implement 'INSERT ... ON CONFLICT' statements for handling duplicates, and add uniqueness constraints to the relevant database tables.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jofpin/trape/ | [email protected] | ProductSource CodeVendor |
| https://github.com/jofpin/trape/issues/408 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-85639 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/895140 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/398787 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/398787/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jofpin trape | 2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |