CVE-2026-85636CWE-287CWE-306

CVE-2026-85636

Medium · published September 4, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00750 · 54.4th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-04T22:18Z
References (7)
https://github.com/jofpin/trape/ · [email protected]https://github.com/jofpin/trape/issues/405 · [email protected]https://vuldb.com/cve/CVE-2026-85636 · [email protected]https://vuldb.com/submit/895135 · [email protected]https://vuldb.com/submit/895141 · [email protected]https://vuldb.com/vuln/398784 · [email protected]https://vuldb.com/vuln/398784/cti · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 18:00Z
    jofpin trape Login Endpoint stats.py missing authentication
    cvelistv5