CVE-2026-126777

Name of the Vulnerable Software and Affected Versions Traccar versions 3.15 through 6.16.x

Description An authentication bypass exists in the LdapProvider.login() function when LDAP authentication is enabled. The system fails to reject empty passwords, which leads to LDAP binds being performed as unauthenticated binds. An attacker who knows a valid username can gain unauthorized access to any account, including administrator accounts, by using an empty password via the POST '/api/session' endpoint or HTTP Basic authentication, provided the directory permits unauthenticated binds.

Recommendations Update to version 6.17.0.