Product
Traccar 3.15 through 6.16.0 contains an authentication bypass in the LdapProvider.login() method, allowing unauthenticated attackers to log in as any user, including administrators, by providing an empty password against an LDAP directory that permits unauthenticated binds.