Is CVE-2026-85637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85637 being exploited in the wild.

How severe is CVE-2026-85637?

Medium severity, with a CVSS score of 5.3, published 4 September 2026.

Is there a fix for CVE-2026-85637?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85637 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85637?

Check whether you run Jofpin Trape at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85637: jofpin trape missing authentication in admin endpoint

CVE-2026-85637 · Severity: medium · CVSS 5.3 · Published 2026-09-04

Trape is an OSINT tool used to track and analyze targets via browser-based social engineering. A missing authentication vulnerability in the admin endpoint allows any network-accessible attacker to hijack victim sessions, inject malicious JavaScript, or redirect users without proper authorization, compromising the integrity of tracked sessions and enabling command injection attacks.

Technologies: Jofpin Trape. Vendors: Jofpin.

Quick answers

Is CVE-2026-85637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85637 being exploited in the wild.
How severe is CVE-2026-85637?: Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?: Jofpin Trape 1.0.0, 2.0.
Is there a fix for CVE-2026-85637?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85637 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85637?: Check whether you run Jofpin Trape at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication issue in the Socket.IO /trape namespace handlers (core/sockets.py, functions join_room and my_room_event). An unauthenticated client can connect to the Socket.IO endpoint and join arbitrary victim rooms by supplying a known victim ID (vId), then emit my_room_event messages with attacker-controlled type and message fields that are re-broadcast to that room. Attack types include jsscript and execute for arbitrary JavaScript injection, redirect for browser redirection, and alert/talk for social engineering. The victim vId can be enumerated via the unauthenticated /get_data endpoint. No authentication or authorization checks validate that the attacker owns the session or is the authenticated operator before allowing these operations. The vulnerability requires network reachability to the Socket.IO endpoint but no user interaction or authentication credentials.

Affected products

jofpin trape 1.0.0, 2.0

Timeline

2026-07-18: disclosed: Issue #406 opened on GitHub
2026-09-04: advisory: CVE-2026-85637 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.