High severity7.4NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-126777
CVE-2026-126777
Description
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/traccar/traccar/blob/v3.15/src/org/traccar/database/LdapProvider.javanvd
- github.com/traccar/traccar/blob/v6.16.0/src/main/java/org/traccar/database/LdapProvider.javanvd
- github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21nvd
- github.com/traccar/traccar/releases/tag/v6.17.0nvd
- www.vulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-empty-ldap-passwordnvd
News mentions
0No linked articles in our index yet.