CVE-2026-126777: Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traccarto a version that resolves this vulnerability.Fixed in 6.17.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Traccar versions from 3.15 before 6.17.0 are affected when LDAP authentication is enabled and the configured LDAP directory permits unauthenticated binds. Deployments not using LDAP authentication are not described as affected.
What does an attacker need to exploit it?
An unauthenticated attacker needs to know a valid username and submit an empty password. The attack can be performed through POST /api/session or HTTP Basic authentication, without user interaction.
What access can exploitation provide?
If the LDAP directory accepts the unauthenticated bind, the attacker can obtain a session for the named account. This includes administrator accounts when the attacker knows a valid administrator username.
How can I determine whether my environment is vulnerable?
Confirm that the Traccar version is earlier than 6.17.0, LDAP authentication is enabled, and the LDAP directory permits unauthenticated binds. Affected behavior involves attempting login for a valid username with an empty password through the session endpoint or HTTP Basic authentication.