CVE-2026-85636: Missing Authentication in jofpin trape

This vulnerability affects jofpin trape version 1.0.0 and involves missing authentication in an unspecified functionality within the core/stats.py file of the Login Endpoint component. The flaw allows remote attackers to bypass authentication controls without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and partial confidentiality impact. The project was notified early but has not responded or provided a fix. Public exploit code exists.

An attacker can remotely bypass authentication on the affected login endpoint, potentially gaining unauthorized access to the system or sensitive functions. The confidentiality impact is partial, indicating some information disclosure or limited unauthorized access may occur. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing compensating controls such as restricting network access to the vulnerable endpoint or monitoring for suspicious activity until an official patch is available.