by Kastro
Paper/Archive/CVE-2026-126777

CVE-2026-126777

Traccar Traccar — Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

CVSS 9.1
critical.is priorityof 100
27
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.

Affected

ProductAffectedFixed inSource
Traccar3.15 – < 6.17.06.17.0CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

patchgithub.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21refgithub.com/traccar/traccar/releases/tag/v6.17.0writeupgithub.com/traccar/traccar/blob/v6.16.0/src/main/java/org/traccar/database/LdapProvider.java#L171-L176writeupgithub.com/traccar/traccar/blob/v3.15/src/org/traccar/database/LdapProvider.java#L163-L169writeupvulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-empty-ldap-password