CVE-2026-108737: Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
The attacker needs a leaked password-reset link or its token. Exploitation also requires user interaction, as reflected by the UI:R vector.
What access can a stolen reset token provide?
A stolen reset token can be reused through /api/session to obtain a full session, or through /api/password/update to change the account password. Access can persist for seven days even after the victim resets their password.
Does resetting the password revoke an attacker’s access?
No. The described behavior allows access obtained from the reused reset token to remain valid for seven days after the victim resets their password.