CVE-2026-126777criticalCWE-287

CVE-2026-126777: fallo crítico en Traccar

Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear traccar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

25Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Traccar · Traccar
CVEs relacionadas — Traccar

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5246HIGHLDAP injection vulnerability in Traccar GPS Tracking SystemEPSS 0.9%CVE-2026-108737HIGHTraccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose ConfusionEPSS 0.3%CVE-2026-108738LOWTraccar 5.7 through 6.16.0 Login CSRF via OpenID Connect CallbackEPSS 0.1%