CVE-2026-85639: Race Condition in jofpin trape

This vulnerability in jofpin trape 2.0 arises from a race condition in the Telemetry Endpoint component, specifically in the core/user.py file where the argument vId is manipulated. The race condition can be triggered remotely without privileges or user interaction, but the attack complexity is high. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. Although the exploit has been publicly disclosed, the vendor has not yet responded or issued a patch.

Successful exploitation of this race condition could allow an attacker to manipulate the Telemetry Endpoint remotely, potentially leading to inconsistent or unauthorized behavior. The medium CVSS score reflects limited impact and high complexity, suggesting that exploitation is difficult and may require precise timing or conditions.

No official fix or patch is currently available from the vendor. Since the vendor has not responded yet, users should monitor the vendor advisory for updates. Due to the high attack complexity and lack of privileges required, immediate exploitation risk is moderate but should be addressed once a patch is released.