CVE-2026-126777criticalCWE-287

CVE-2026-126777: falha crítica em Traccar

Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar traccar

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.5%
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Traccar · Traccar
CVEs relacionadas — Traccar

No mesmo produto, das mais perigosas para as menos.

CVE-2020-5246HIGHLDAP injection vulnerability in Traccar GPS Tracking SystemEPSS 0.9%CVE-2026-108737HIGHTraccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose ConfusionEPSS 0.3%CVE-2026-108738LOWTraccar 5.7 through 6.16.0 Login CSRF via OpenID Connect CallbackEPSS 0.1%