CVE-2026-126777
highTraccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to…
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/traccar/traccar/blob/v3.15/src/org/traccar/database/LdapProvider.java#L... disclosure@vulncheck.com
- https://github.com/traccar/traccar/blob/v6.16.0/src/main/java/org/traccar/database/LdapPro... disclosure@vulncheck.com
- https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21 disclosure@vulncheck.com
- https://github.com/traccar/traccar/releases/tag/v6.17.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-... disclosure@vulncheck.com