CVE-2026-126777criticalCWE-287

CVE-2026-126777: critical vulnerability in Traccar

Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Published · Updated

Follow this CVE+ Monitor traccar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.5%
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Traccar · Traccar
Related CVEs — Traccar

In the same product, most dangerous first.

CVE-2020-5246HIGHLDAP injection vulnerability in Traccar GPS Tracking SystemEPSS 0.9%CVE-2026-108737HIGHTraccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose ConfusionEPSS 0.3%CVE-2026-108738LOWTraccar 5.7 through 6.16.0 Login CSRF via OpenID Connect CallbackEPSS 0.1%