Description
A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Patch Now
AI Analysis

Impact

The flaw exists in the join_room function of the Admin Endpoint in jofpin:trape. The endpoint omits authentication checks, allowing remote users to invoke the API and join any room without credentials, thereby gaining unauthorized access to room resources and the data they exchange.

Affected Systems

The vulnerability affects jofpin:trape versions 1.0.0 and 2.0, located in the core/sockets.py file of the Admin Endpoint component.

Risk and Exploitability

The CVSS score is 6.9, which classifies the issue as medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be exploited remotely, and public exploit code has already been released, meaning attackers could abuse the missing authentication if the affected systems remain exposed.

Generated by OpenCVE AI on September 4, 2026 at 20:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest jofpin:trape release that includes a fix for the missing authentication guard.
  • Limit public exposure of the Admin Endpoint by configuring network firewalls or VPN gateways so that only trusted administrators can reach it.
  • Insert an authentication check into the join_room handler—verify a valid admin token or credential before allowing any room join—until a vendor patch is available.

Generated by OpenCVE AI on September 4, 2026 at 20:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title jofpin trape Admin Endpoint sockets.py join_room missing authentication
First Time appeared Jofpin
Jofpin trape
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:jofpin:trape:*:*:*:*:*:*:*:*
Vendors & Products Jofpin
Jofpin trape
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jofpin Trape
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T19:21:23.942Z

Reserved: 2026-09-04T12:19:22.047Z

Link: CVE-2026-85637

cve-icon Vulnrichment

Updated: 2026-09-04T19:21:20.828Z

cve-icon NVD

Status : Deferred

Published: 2026-09-04T19:17:33.263

Modified: 2026-09-08T13:12:58.310

Link: CVE-2026-85637

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:26:00Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function