CVE-2026-108737

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.16.1

Description A weak password recovery mechanism exists because the TokenManager does not bind tokens to a specific purpose. This allows an attacker with a leaked password reset link to reuse the token as session credentials. By using the '/api/session' endpoint, an attacker can obtain a full session, or by using the '/api/password/update' endpoint, they can change the account password. This access can persist for seven days, even if the victim resets their password.

Recommendations Update to a version newer than 6.16.0.