{"id":"CVE-2026-126777","kind":"vulnerability","aliases":["CVE-2026-126777"],"related":[],"title":"Traccar: empty LDAP password logs in any known user, including admins","description":"Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.","summary":"Traccar's LDAP login accepts an empty password and performs an unauthenticated LDAP bind, so anyone who knows a valid username gets a session. The session can belong to any account, including administrators.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ldap","package","self-hosted","traccar"],"not_affected_if":["authenticated-binds-only","ldap-disabled","managed-hosting"],"how_to_check":"- Check the Traccar version with `java -jar tracker-server.jar --version` or the version shown in the web UI; versions from 3.15 up to but not including `6.17.0` are affected\n- Check whether LDAP is enabled in `traccar.xml` or the config for `ldap.url` or `ldap.` settings\n- Check whether the LDAP directory allows anonymous or unauthenticated binds","fix":"- Upgrade Traccar to `6.17.0` or later","status":"open","published_at":"2026-11-11T19:17:38+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:29:41+00:00","updated_at":"2026-11-11T19:29:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T19:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Traccar to `6.17.0` or later","reach":"internet","title":"Traccar: empty LDAP password logs in any known user, including admins","impact":"high","summary":"Traccar's LDAP login accepts an empty password and performs an unauthenticated LDAP bind, so anyone who knows a valid username gets a session. The session can belong to any account, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traccar","ldap","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as any user, including administrators, over the network","analyst_note":"","how_to_check":"- Check the Traccar version with `java -jar tracker-server.jar --version` or the version shown in the web UI; versions from 3.15 up to but not including `6.17.0` are affected\n- Check whether LDAP is enabled in `traccar.xml` or the config for `ldap.url` or `ldap.` settings\n- Check whether the LDAP directory allows anonymous or unauthenticated binds","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["ldap-disabled","authenticated-binds-only","managed-hosting"],"who_is_affected":"Only Traccar installs with LDAP authentication enabled are exposed, and the directory must accept unauthenticated binds. Installs using only local accounts are not affected by this flaw. Anyone running a self-hosted Traccar server with LDAP login should check it first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000756,"input_tokens":4669,"output_tokens":578,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126777':14A,17A '-2026':13A,16A '/api/session':100C '3.15':58C '6.17.0':60C 'accept':28B 'account':54B,119C 'admin':11A 'administr':56B,121C 'anyon':39B 'attack':89C 'authent':63C,85C,104C 'basic':103C 'belong':51B 'bind':37B,76C,82C,114C 'bypass':64C 'caus':74C 'contain':61C 'cve':12A,15A 'directori':110C 'empti':2A,30B,72C,107C 'enabl':87C 'fail':69C 'get':45B 'host':22B 'http':102C 'includ':10A,55B,120C 'know':41B,91C 'known':8A 'ldap':3A,18B,26B,36B,75C,84C 'ldapprovider.login':67C 'log':5A,96C 'login':27B 'obtain':115C 'packag':19B 'password':4A,31B,73C,108C 'perform':33B,79C 'permit':112C 'post':99C 'reject':71C 'self':21B 'self-host':20B 'session':47B,49B,116C 'traccar':1A,23B,24B,57C 'unauthent':35B,81C,88C,113C 'user':9A 'usernam':44B,94C 'valid':43B,93C 'via':98C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Only Traccar installs with LDAP authentication enabled are exposed, and the directory must accept unauthenticated binds. Installs using only local accounts are not affected by this flaw. Anyone running a self-hosted Traccar server with LDAP login should check it first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ldap","package","selfhosted","traccar"],"campaign_type":null,"search_a":"'-126777':14A,17A '-2026':13A,16A 'admin':11A 'cve':12A,15A 'empti':2A 'includ':10A 'known':8A 'ldap':3A 'log':5A 'password':4A 'traccar':1A 'user':9A","search_b":"'accept':28B 'account':54B 'administr':56B 'anyon':39B 'belong':51B 'bind':37B 'empti':30B 'get':45B 'host':22B 'includ':55B 'know':41B 'ldap':18B,26B,36B 'login':27B 'packag':19B 'password':31B 'perform':33B 'self':21B 'self-host':20B 'session':47B,49B 'traccar':23B,24B 'unauthent':35B 'usernam':44B 'valid':43B","search_c":"'/api/session':100C '3.15':58C '6.17.0':60C 'account':119C 'administr':121C 'attack':89C 'authent':63C,85C,104C 'basic':103C 'bind':76C,82C,114C 'bypass':64C 'caus':74C 'contain':61C 'directori':110C 'empti':72C,107C 'enabl':87C 'fail':69C 'http':102C 'includ':120C 'know':91C 'ldap':75C,84C 'ldapprovider.login':67C 'log':96C 'obtain':115C 'password':73C,108C 'perform':79C 'permit':112C 'post':99C 'reject':71C 'session':116C 'traccar':57C 'unauthent':81C,88C,113C 'usernam':94C 'valid':93C 'via':98C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126777","severity":null,"published_at":"2026-11-11T19:17:38+00:00","modified_at":"2026-11-11T19:17:38+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[{"id":128116,"url":"https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128119,"url":"https://github.com/traccar/traccar/releases/tag/v6.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128120,"url":"https://www.vulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-empty-ldap-password","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}