Jofpin - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/jofpin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 19:27:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass Vulnerability in jofpin trapehttps://feed.craftedsignal.io/briefs/2026-09-trape-auth-bypass/Fri, 04 Sep 2026 19:27:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-trape-auth-bypass/An authorization bypass vulnerability in jofpin trape 2.0, triggered by manipulating the vId or id arguments, allows remote attackers to gain unauthorized access.A security weakness has been identified in jofpin trape version 2.0, specifically within the core/user.py file. This vulnerability enables an authorization bypass through the manipulation of the 'vId' or 'id' arguments during user sessions. The flaw allows remote attackers to interact with the application without proper authentication, potentially leading to unauthorized data access or administrative control. An exploit for this vulnerability is currently publicly available, increasing the risk of exploitation. The vendor has been notified of the issue but has not yet provided a resolution or patch. Defenders should note that trape is often used for security research and tracking, making this an attractive target for unauthorized access.

Impact

Successful exploitation of CVE-2026-85638 allows unauthenticated remote attackers to bypass authorization mechanisms within the trape tool. This could allow attackers to monitor, manage, or exfiltrate sensitive data collected by the tool. Given the nature of the application as a tracking and security tool, compromise could lead to the exposure of collected user metadata or the manipulation of tracking campaigns.

Recommendation

  • Restrict access to the trape interface using network-level controls (e.g., VPN, firewall rules) until a vendor patch is released.
  • Implement monitoring for requests targeting the application that include manipulated 'vId' or 'id' query parameters.
  • Monitor web server access logs for any anomalous patterns originating from unauthenticated sessions that attempt to access restricted functionality within core/user.py logic.
]]>highadvisoryvulnerabilityweb-applicationaccess-control