CVE-2026-48745

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20

Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or notification. An attacker can use a crafted link delivered via SMS, email, a webpage, or another app to hijack GPS tracking parameters, including the server URL, device ID, accuracy, distance, and interval. This enables the covert redirection of real-time GPS telemetry to an attacker-controlled server at maximum precision and frequency, with the changes persisting across device restarts.

Recommendations Update to version 9.7.20.