3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Not on CISA's list of exploited flaws, and not in the news we track.
9.1of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126777. Nothing runs until you send it.
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.