CVE-2026-108738
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.
Risk Assessment
An attacker can capture data entered by the victim, including registered device information, leading to data leakage and privacy breaches. The risk also includes manipulation of the victim's device configuration.
Recommendation
Update Traccar to a version later than 6.16.0 if available, and implement state parameter validation in the OpenID Connect callback. Inform users about the risk and recommend verifying registered devices.
Other vulnerabilities in Traccar
See all- CVE-2026-108737Medium
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.
- CVE-2026-52852Medium
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.
- CVE-2026-52851High
In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.
- CVE-2026-44314Medium
Traccar before 6.13.0 has a vulnerability in DeviceResource.uploadImage that authorizes the device only via Condition.Permission, but does not check readonly/deviceReadonly for non-admins. An unauthorized user can replace a device's image in the server media directory.
- CVE-2025-61666High
Traccar versions 6.1-6.8.1 (default installs) and 5.8-6.0 (non-default installs with web.override enabled) are vulnerable to unauthenticated local file inclusion attacks, which can lead to leakage of passwords or any file on the filesystem, including the Traccar configuration file. The vulnerable code is removed in version 6.9.0.
Original NVD description (English source)
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS