Executive brief
Trape is an OSINT analysis tool used to track individuals and execute social engineering attacks. A race condition in the victim registration endpoint allows attackers to create duplicate victim records by sending multiple concurrent requests with the same victim ID, corrupting application data and causing service errors.
Technical details
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the /register endpoint (core/user.py, lines 72–102). The code checks if a victim ID already exists via a count_times query, then conditionally performs INSERT or UPDATE operations—but these are separate SQL statements with no transaction boundary or application-level locking. An attacker can send two concurrent POST requests with an identical, attacker-controlled vId parameter; both requests will read count_times as 0 before either commits, causing both to execute INSERT statements. While the geo table has a PRIMARY KEY constraint that stops one of them with an IntegrityError, the victims, victims_data, and victims_battery tables lack uniqueness constraints, resulting in duplicate rows for the same vId. This corrupts analytics and triggers unhandled 500 errors on concurrent registrations. The attack requires network access to the /register endpoint and no authentication; it is highly complex but has been publicly disclosed.
Affected products
- jofpin trape 2.0
Timeline
- 2026-07-18: disclosed: Security issue #408 reported on GitHub
- 2026-09-04: advisory: CVE-2026-85639 published