Authentication Bypass Vulnerability in Traccar by Traccar

CVE-2026-126777

What is CVE-2026-126777?

An authentication bypass vulnerability has been identified in Traccar 3.15 through 6.17.0, specifically in the LdapProvider.login() method. This flaw allows unauthenticated attackers to successfully log in using valid usernames with empty passwords, particularly in systems where LDAP authentication is enabled and unauthenticated binds are accepted. Consequently, this vulnerability may grant these unauthorized users access to sensitive sessions, potentially including administrator accounts. It is crucial for users operating affected versions to update their systems to ensure security.

References