Traccar: Authentication Bypass via LDAP (CVE-2026-126777)

Traccar versions 3.15 through 6.16.0 are vulnerable to an authentication bypass in the LdapProvider.login() method. When LDAP authentication is enabled and the backend directory server permits unauthenticated binds, the application fails to validate empty password submissions. This allows an attacker who possesses a valid username to log in as that user, including accounts with administrative privileges, via the /api/session endpoint or HTTP Basic authentication.

Impact

Successful exploitation allows unauthenticated attackers to gain full access to any user account within the Traccar instance. This includes access to administrative accounts, which could lead to complete system compromise, unauthorized data access, and unauthorized control over tracked devices.

Recommendation

• Immediately upgrade Traccar to version 6.17.0 or later.
• Audit existing LDAP directory server configurations to ensure they do not permit unauthenticated binds, which is a prerequisite for this vulnerability to be exploitable.