Is CVE-2026-85636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85636 being exploited in the wild.

How severe is CVE-2026-85636?

Medium severity, with a CVSS score of 5.3, published 4 September 2026.

Is there a fix for CVE-2026-85636?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85636 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85636?

Check whether you run Jofpin Trape at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85636: jofpin trape authentication bypass in admin API endpoints

CVE-2026-85636 · Severity: medium · CVSS 5.3 · Published 2026-09-04

Trape is an open-source OSINT and social engineering research tool used to track people on the internet. The application's admin API endpoints lack proper session enforcement after login, allowing any network-connected attacker to read all captured victim data (IP addresses, locations, credentials) or tamper with victim records without knowing the administrative key. This completely compromises the confidentiality and integrity of sensitive information collected by the tool.

Technologies: Jofpin Trape. Vendors: Jofpin.

Quick answers

Is CVE-2026-85636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85636 being exploited in the wild.
How severe is CVE-2026-85636?: Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?: Jofpin Trape 1.0.0.
Is there a fix for CVE-2026-85636?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85636 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85636?: Check whether you run Jofpin Trape at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the login endpoint (core/stats.py lines 51–57) and subsequent API endpoints. The /login route validates a POST'd ID against the stats_key but never creates a server-side Flask session, sets a signed cookie, or issues a token—it only returns operator paths in JSON. Subsequent admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /pn, and the dynamically generated remove path) do not verify the caller's identity. An attacker can directly invoke these endpoints with any network access, bypassing the login entirely. The fix requires establishing signed server-side sessions or issuing short-lived tokens and validating credentials on every admin endpoint before executing queries.

Affected products

jofpin trape 1.0.0

Timeline

2026-09-04: disclosed: CVE-2026-85636 published
2026-07-18: other: Security issue reported by Galaxync on GitHub (issue #405)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.