CVE-2026-85639

Deferred Deferred - Pending Action

Race Condition in Trape 2.0 Telemetry Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-10

Assigner: VulDB

Description

A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-10

Generated

2026-09-25

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-23

NVD

CVE-2026-85639

EUVD

EUVD-2026-71693

Affected Vendors & Products

Vendor	Product	Version / Range
jofpin	trape	2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Telemetry Endpoint of jofpin trape 2.0, specifically in the core/user.py file. It is triggered by manipulating the vId argument, allowing remote attackers to exploit it. The exploit is public but considered difficult to execute.

Detection Guidance

To detect this vulnerability, monitor for duplicate victim entries in the victims, victims_data, and victims_battery tables with the same vId. Check for unhandled sqlite3.IntegrityError exceptions (500 errors) in logs. Inspect the core/user.py file (lines 72-102) and core/db.py (line 25) for non-atomic check-then-act sequences in the /register endpoint. Use SQL queries to verify if tables lack uniqueness constraints for vId.

Impact Analysis

The impact includes potential unauthorized access or manipulation of data due to the race condition. However, the complexity of the exploit and lack of vendor response may limit immediate risk. Users should monitor updates or apply mitigations if available.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves a race condition in the Telemetry Endpoint of jofpin trape 2.0, which could potentially lead to unauthorized access or data integrity issues. However, without explicit details on data types affected or compliance implications, it is unclear how this vulnerability would specifically impact regulatory compliance.

Mitigation Strategies

Immediate steps include monitoring for unusual activity in core/user.py, especially related to the Telemetry Endpoint and the vId argument. Since the project has not responded, consider isolating affected systems or disabling the Telemetry Endpoint if possible to prevent remote exploitation.

Hi! I’m here to help you understand CVE-2026-85639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70