Executive brief
Trape is an OSINT tool used to track and analyze targets via browser-based social engineering. A missing authentication vulnerability in the admin endpoint allows any network-accessible attacker to hijack victim sessions, inject malicious JavaScript, or redirect users without proper authorization, compromising the integrity of tracked sessions and enabling command injection attacks.
Technical details
The vulnerability is a missing authentication issue in the Socket.IO /trape namespace handlers (core/sockets.py, functions join_room and my_room_event). An unauthenticated client can connect to the Socket.IO endpoint and join arbitrary victim rooms by supplying a known victim ID (vId), then emit my_room_event messages with attacker-controlled type and message fields that are re-broadcast to that room. Attack types include jsscript and execute for arbitrary JavaScript injection, redirect for browser redirection, and alert/talk for social engineering. The victim vId can be enumerated via the unauthenticated /get_data endpoint. No authentication or authorization checks validate that the attacker owns the session or is the authenticated operator before allowing these operations. The vulnerability requires network reachability to the Socket.IO endpoint but no user interaction or authentication credentials.
Affected products
- jofpin trape 1.0.0, 2.0
Timeline
- 2026-07-18: disclosed: Issue #406 opened on GitHub
- 2026-09-04: advisory: CVE-2026-85637 published on NVD