CVE-2026-85637: Missing Authentication in jofpin trape

This vulnerability affects the join_room function in the core/sockets.py file of the Admin Endpoint in jofpin trape versions 1.0.0 and 2.0. Due to missing authentication controls, remote attackers can invoke this function without credentials, potentially bypassing access restrictions. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. Public exploit code is available, increasing the risk of attack. No official remediation or patch has been released by the vendor.

The missing authentication in the join_room function allows unauthenticated remote attackers to access administrative functionality or join restricted rooms, which could lead to unauthorized access or manipulation within the application. The CVSS score of 6.9 indicates a medium severity impact, with network attack vector and no privileges or user interaction required. However, no confirmed active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing network-level access controls or other compensating controls to restrict access to the affected Admin Endpoint. Review application logs for suspicious join_room activity and limit exposure of the vulnerable service to untrusted networks.