{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atraccartraccar/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-126777"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Traccar (3.15 \u003c= 6.16.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Traccar"],"content_html":"\u003cp\u003eTraccar versions 3.15 through 6.16.0 are vulnerable to an authentication bypass in the LdapProvider.login() method. When LDAP authentication is enabled and the backend directory server permits unauthenticated binds, the application fails to validate empty password submissions. This allows an attacker who possesses a valid username to log in as that user, including accounts with administrative privileges, via the /api/session endpoint or HTTP Basic authentication.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain full access to any user account within the Traccar instance. This includes access to administrative accounts, which could lead to complete system compromise, unauthorized data access, and unauthorized control over tracked devices.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Traccar to version 6.17.0 or later.\u003c/li\u003e\n\u003cli\u003eAudit existing LDAP directory server configurations to ensure they do not permit unauthenticated binds, which is a prerequisite for this vulnerability to be exploitable.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:05:24Z","date_published":"2026-11-11T20:05:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-traccar-auth-bypass-cve-2026-126777/","summary":"Traccar 3.15 through 6.16.0 contains an authentication bypass in the LdapProvider.login() method, allowing unauthenticated attackers to log in as any user, including administrators, by providing an empty password against an LDAP directory that permits unauthenticated binds.","title":"Traccar: Authentication Bypass via LDAP (CVE-2026-126777)","url":"https://feed.craftedsignal.io/briefs/2026-11-traccar-auth-bypass-cve-2026-126777/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}