CVE-2026-85638: Authorization Bypass in jofpin trape

This vulnerability in jofpin trape 2.0 involves an authorization bypass caused by manipulation of the argument vId/id in the core/user.py file. This flaw allows an attacker to bypass authorization controls remotely without requiring privileges or user interaction. The exploit code has been publicly disclosed, increasing the risk of exploitation. The vendor has been notified but has not provided a response or patch at the time of this report.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization mechanisms, potentially gaining unauthorized access to restricted functionality or data within jofpin trape 2.0. The availability of a public exploit increases the likelihood of attacks. However, no evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider restricting access to affected components or implementing additional access controls as a temporary measure.