Executive brief
Trape is an open-source OSINT and social engineering research tool used to track people on the internet. The application's admin API endpoints lack proper session enforcement after login, allowing any network-connected attacker to read all captured victim data (IP addresses, locations, credentials) or tamper with victim records without knowing the administrative key. This completely compromises the confidentiality and integrity of sensitive information collected by the tool.
Technical details
The vulnerability is an authentication bypass in the login endpoint (core/stats.py lines 51–57) and subsequent API endpoints. The /login route validates a POST'd ID against the stats_key but never creates a server-side Flask session, sets a signed cookie, or issues a token—it only returns operator paths in JSON. Subsequent admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /pn, and the dynamically generated remove path) do not verify the caller's identity. An attacker can directly invoke these endpoints with any network access, bypassing the login entirely. The fix requires establishing signed server-side sessions or issuing short-lived tokens and validating credentials on every admin endpoint before executing queries.
Affected products
- jofpin trape 1.0.0
Timeline
- 2026-09-04: disclosed: CVE-2026-85636 published
- 2026-07-18: other: Security issue reported by Galaxync on GitHub (issue #405)