CVE-2026-126777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126777
Published
2026-11-11T18:41:09Z
Modified
2026-11-14T07:04:30Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Details

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126777.json"
}
References

Affected packages

Git / github.com/traccar/traccar

Affected ranges

Type
GIT
Repo
https://github.com/traccar/traccar
Events
Introduced
9ae75e701499d07fca67dc45f9be748e04752fea
Fixed
45ae7321fe56688ca26f2f5b62e6dbb7a4737562
Fixed
552c31f2097dbed9edef7cfe174c50b16febdc21
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.15"
                },
                {
                    "fixed": "6.17.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "552c31f2097dbed9edef7cfe174c50b16febdc21"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v6.17.0",
            "range": [
                {
                    "fixed": "45ae7321fe56688ca26f2f5b62e6dbb7a4737562"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v3.*
v3.15
v3.16
v3.17
v4.*
v4.0
v4.1
v4.10
v4.11
v4.12
v4.13
v4.14
v4.15
v4.2
v4.3
v4.4
v4.5
v4.6
v4.7
v4.8
v4.9
v5.*
v5.0
v5.1
v5.10
v5.11
v5.12
v5.2
v5.3
v5.4
v5.5
v5.6
v5.7
v5.8
v5.9
v6.*
v6.0
v6.1
v6.10.0
v6.11.0
v6.11.1
v6.12.0
v6.12.1
v6.12.2
v6.13.0
v6.13.1
v6.13.2
v6.13.3
v6.14.0
v6.14.1
v6.14.2
v6.14.3
v6.14.4
v6.14.5
v6.15.0
v6.15.1
v6.15.2
v6.15.3
v6.16.0
v6.2
v6.3
v6.4
v6.5
v6.6
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.8.0
v6.8.1
v6.9.0
v6.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126777.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "13251297299008892420221293995281235985",
                "209445344245324046907718677720808291858",
                "141356332397870930196322661921951956446",
                "5000593289802024773318833279526897652",
                "294599466536533909751554687195206986948"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126777-27d10edd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21",
        "target": {
            "file": "src/main/java/org/traccar/database/LdapProvider.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287414754422211662047372482610517616657",
            "length": 245
        },
        "id": "CVE-2026-126777-9c18a26b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21",
        "target": {
            "file": "src/main/java/org/traccar/database/LdapProvider.java",
            "function": "login"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:30Z"