CVE Alert: CVE-2026-126777 – Traccar

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.

**Risk verdict:** This is a high-impact, remotely reachable authentication bypass, but no KEV or active SSVC exploitation flag is supplied, so urgent exploitation status is unconfirmed.

**Why this matters:** A successful login could expose sensitive fleet and location information or let an attacker alter operational data under the victim’s account. Administrator access could enable wider control of the tracking environment; directory-wide access or lateral movement is not established by the supplied data.

**Most likely attack path:** The attacker needs network reachability, a valid username and an LDAP configuration that permits unauthenticated binds; no prior privileges or user interaction are indicated. The attack is otherwise low-complexity, with impact apparently confined to the application’s security authority rather than automatically extending to other systems.

**Who is most exposed:** Organisations running the platform with LDAP authentication enabled and reachable login endpoints are most at risk. Exposure depends on directory bind policy and account naming being discoverable or known.

Alert on successful logins with empty passwords, especially against privileged accounts.

Review application and proxy logs for unusual session creation or Basic authentication attempts.

Correlate new sessions with subsequent account, device, or tracking-data changes.

Check LDAP logs for anonymous or unauthenticated bind attempts.

Mitigation and prioritisation

Confirm KEV, SSVC and EPSS status; these are not present in the supplied data. If KEV is true or EPSS is at least 0.5, treat as priority 1.

Upgrade to the fixed release or later; expedite after testing compatibility.

Until patched, disable LDAP authentication or restrict access to the login endpoint and application network.

Verify directory policy rejects unauthenticated binds; review privileged accounts and recent activity.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.