CVE-2026-25649: Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The redirecturi parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25649?
CVE-2026-25649 has been classified with a high severity rating due to the potential for authorization code theft.
How do I fix CVE-2026-25649?
To fix CVE-2026-25649, upgrade Traccar to version 6.11.2 or later to eliminate the vulnerability.
What systems are affected by CVE-2026-25649?
CVE-2026-25649 affects Traccar versions up to and including 6.11.1.
What is the impact of CVE-2026-25649?
The impact of CVE-2026-25649 allows authenticated users to steal OAuth 2.0 authorization codes, potentially compromising user accounts.
Is there a workaround for CVE-2026-25649?
At this time, no official workaround is available for CVE-2026-25649; upgrading to a secure version is recommended.