Medium severity6.8NVD Advisory· Published Oct 11, 2026· Updated Oct 11, 2026
CVE-2026-108737
CVE-2026-108737
Description
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/PasswordResource.javanvd
- github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.javanvd
- github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/signature/TokenManager.javanvd
- hackmd.io/@haind/traccar-token-purpose-confusionnvd
- www.vulncheck.com/advisories/traccar-through-6.16.0-weak-password-recovery-via-tokenmanager-token-purpose-confusionnvd
News mentions
0No linked articles in our index yet.