Traccar (3.15 <= 6.16.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/traccar-3.15--6.16.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:05:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTraccar: Authentication Bypass via LDAP (CVE-2026-126777)https://feed.craftedsignal.io/briefs/2026-11-traccar-auth-bypass-cve-2026-126777/Wed, 11 Nov 2026 20:05:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-traccar-auth-bypass-cve-2026-126777/Traccar 3.15 through 6.16.0 contains an authentication bypass in the LdapProvider.login() method, allowing unauthenticated attackers to log in as any user, including administrators, by providing an empty password against an LDAP directory that permits unauthenticated binds.Traccar versions 3.15 through 6.16.0 are vulnerable to an authentication bypass in the LdapProvider.login() method. When LDAP authentication is enabled and the backend directory server permits unauthenticated binds, the application fails to validate empty password submissions. This allows an attacker who possesses a valid username to log in as that user, including accounts with administrative privileges, via the /api/session endpoint or HTTP Basic authentication.

Impact

Successful exploitation allows unauthenticated attackers to gain full access to any user account within the Traccar instance. This includes access to administrative accounts, which could lead to complete system compromise, unauthorized data access, and unauthorized control over tracked devices.

Recommendation

  • Immediately upgrade Traccar to version 6.17.0 or later.
  • Audit existing LDAP directory server configurations to ensure they do not permit unauthenticated binds, which is a prerequisite for this vulnerability to be exploitable.
]]>highadvisory