Jofpin
Monthly
Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure.
Authorization bypass via insecure direct object reference (IDOR) in jofpin trape 2.0 allows remote unauthenticated attackers to access or manipulate tracked-subject records by substituting arbitrary values for the vId/id parameters handled in core/user.py. The affected product is an open-source Python OSINT people-tracking framework; exploitation requires only network reachability to the trape instance with no credentials or user interaction. A public proof-of-concept exists via GitHub issue #407, and the vendor has not responded to the disclosure.
Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure.
Authorization bypass via insecure direct object reference (IDOR) in jofpin trape 2.0 allows remote unauthenticated attackers to access or manipulate tracked-subject records by substituting arbitrary values for the vId/id parameters handled in core/user.py. The affected product is an open-source Python OSINT people-tracking framework; exploitation requires only network reachability to the trape instance with no credentials or user interaction. A public proof-of-concept exists via GitHub issue #407, and the vendor has not responded to the disclosure.
Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure.