CVE-2026-85638: jofpin trape 2.0 Auth Bypass Vulnerability

CVE-2026-85638 Overview

CVE-2026-85638 is an authorization bypass vulnerability in jofpin/trape version 2.0, an open-source people and device tracking research tool written in Python. The flaw resides in the core/user.py file, where improper authorization checks on the vId/id argument allow remote attackers to bypass access controls. The weakness is classified under CWE-285: Improper Authorization. A public exploit is available, and the project maintainers have not responded to the issue report filed against the repository.

Critical Impact
Remote attackers can bypass authorization checks in the trape web interface by manipulating the vId/id parameter, gaining unauthorized access to tracked user data without authentication.

Affected Products

jofpin/trape version 2.0
The vulnerable component is core/user.py
No official vendor advisory or fixed release is available

Discovery Timeline

2026-09-04 - CVE-2026-85638 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-85638

Vulnerability Analysis

The vulnerability affects trape, a Python-based OSINT and tracking tool that exposes a web dashboard for monitoring victim sessions. The core/user.py module handles user-context operations tied to session identifiers passed via the vId or id parameter. The application fails to properly verify that the requesting client is authorized to act on the referenced identifier, resulting in improper authorization (CWE-285).

Because the check is missing or insufficient, an unauthenticated remote user can substitute another session or user identifier and access data or functionality that should be scoped to the legitimate operator. Confidentiality, integrity, and availability are each impacted at a limited level according to the CVSS 4.0 vector. The exploit is publicly available, which raises the practical likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is missing or inadequate authorization enforcement on the vId/id argument in core/user.py. The code accepts the identifier from client input and acts on the referenced object without verifying the requester's ownership or privilege over that identifier. This is a canonical Insecure Direct Object Reference pattern.

Attack Vector

Exploitation is network-based, requires no privileges, and no user interaction. An attacker crafts an HTTP request to the exposed trape service and supplies a chosen vId or id value to reference a session or user record they do not own. Because the vulnerable code path does not gate the operation on the caller's identity, the request succeeds. See the GitHub issue tracker and VulDB entry for CVE-2026-85638 for additional technical context.

No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-85638

Indicators of Compromise

HTTP requests to trape endpoints containing vId or id parameters that iterate or enumerate identifier values from a single source address.
Access log entries showing requests to user-scoped routes from clients that never completed the operator authentication flow.
Unexpected outbound data transfers from hosts running trape following requests to core/user.py handlers.

Detection Strategies

Deploy web application firewall (WAF) rules that flag identifier enumeration patterns against trape endpoints handling vId or id.
Baseline legitimate operator source addresses and alert on requests to user-context routes from unrecognized clients.
Monitor for anomalous session creation, retrieval, or modification events tied to the core/user.py code path.

Monitoring Recommendations

Enable verbose access logging on any reverse proxy fronting trape and forward logs to a centralized analytics platform.
Track request rates against user-scoped endpoints and alert on ratios of unauthenticated to authenticated access above baseline.
Correlate authentication events with subsequent vId/id operations to identify requests that skip the login flow.

How to Mitigate CVE-2026-85638

Immediate Actions Required

Remove any internet-exposed trape 2.0 instances from public networks until a fix is available.
Place trape deployments behind an authenticating reverse proxy or VPN so that unauthenticated requests to core/user.py cannot reach the application.
Audit access logs for prior requests that manipulated vId or id parameters and treat matching sessions as potentially compromised.

Patch Information

No official patch is available at the time of writing. According to the CVE record, the project was notified through GitHub issue #407 but has not responded. Users should track the jofpin/trape repository for future releases and monitor the VulDB advisory for CVE-2026-85638 for updates.

Workarounds

Enforce authentication at a reverse proxy layer (for example, nginx with auth_basic or an OAuth2 proxy) in front of the trape service.
Restrict network access to the trape management interface using host-based firewalls or security group rules that allow only trusted source addresses.
If self-maintaining a fork, add server-side authorization checks in core/user.py that validate the requesting session owns or has privilege over the supplied vId/id value before processing the request.

bash

# Example: restrict trape to localhost and require authenticated reverse proxy access
# Bind trape to loopback only
export TRAPE_HOST=127.0.0.1
export TRAPE_PORT=8080

# nginx snippet: require basic auth for all trape routes
# location / {
#     auth_basic "trape operators";
#     auth_basic_user_file /etc/nginx/.htpasswd;
#     proxy_pass http://127.0.0.1:8080;
# }

# Host firewall: allow only trusted operator IP
sudo iptables -A INPUT -p tcp --dport 8080 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP