# CVE-2026-85639: jofpin trape race condition in victim registration

Source: https://junglewise.ai/threats/cve-2026-85639-jofpin-trape-race-condition-in-victim-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85639 · Severity: medium · CVSS 5.6 · Published 2026-09-04

Trape is an OSINT analysis tool used to track individuals and execute social engineering attacks. A race condition in the victim registration endpoint allows attackers to create duplicate victim records by sending multiple concurrent requests with the same victim ID, corrupting application data and causing service errors.

Technologies: [Jofpin Trape](https://junglewise.ai/threats/technologies/trape). Vendors: [Jofpin](https://junglewise.ai/threats/vendors/jofpin).

## Quick answers

**Is CVE-2026-85639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85639 being exploited in the wild.

**How severe is CVE-2026-85639?** Medium severity, with a CVSS score of 5.6, published 4 September 2026.

**Which products and versions are affected?** Jofpin Trape 2.0.

**Is there a fix for CVE-2026-85639?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85639 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85639?** Check whether you run Jofpin Trape at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the /register endpoint (core/user.py, lines 72–102). The code checks if a victim ID already exists via a count_times query, then conditionally performs INSERT or UPDATE operations—but these are separate SQL statements with no transaction boundary or application-level locking. An attacker can send two concurrent POST requests with an identical, attacker-controlled vId parameter; both requests will read count_times as 0 before either commits, causing both to execute INSERT statements. While the geo table has a PRIMARY KEY constraint that stops one of them with an IntegrityError, the victims, victims_data, and victims_battery tables lack uniqueness constraints, resulting in duplicate rows for the same vId. This corrupts analytics and triggers unhandled 500 errors on concurrent registrations. The attack requires network access to the /register endpoint and no authentication; it is highly complex but has been publicly disclosed.

## Affected products

- jofpin trape 2.0

## Timeline

- 2026-07-18: disclosed: Security issue #408 reported on GitHub
- 2026-09-04: advisory: CVE-2026-85639 published

## References

- [https://github.com/jofpin/trape/](https://github.com/jofpin/trape/)
- [https://github.com/jofpin/trape/issues/408](https://github.com/jofpin/trape/issues/408)

## Related threats

- [jofpin trape authorization bypass in telemetry endpoints](https://junglewise.ai/threats/cve-2026-85638-jofpin-trape-authorization-bypass-in-telemetry-endpoints)
- [jofpin trape missing authentication in admin endpoint](https://junglewise.ai/threats/cve-2026-85637-jofpin-trape-missing-authentication-in-admin-endpoint)
- [jofpin trape authentication bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-85636-jofpin-trape-authentication-bypass-in-admin-api-endpoints)