Traccar: Authentication bypass via empty LDAP password
Summary
Traccar versions 3.15 up to 6.17.0 accept an empty password when LDAP authentication is enabled, so the server performs an unauthenticated LDAP bind. An unauthenticated attacker who knows a valid username can obtain a session for that account, including administrator accounts, via POST /api/session or HTTP Basic authentication. The attack only works if the LDAP directory permits unauthenticated binds.
Affected
- Traccar 3.15 up to, but not including, 6.17.0
- Only installations with LDAP authentication enabled are affected.
Fixed in
- Upgrade to Traccar 6.17.0 or later (released 1 Nov 2026).
Workaround
- No vendor workaround documented.
- Interim measures (analyst recommendations, not from the vendor): disable LDAP login until the upgrade is complete, and use local accounts in the meantime.
- Disable anonymous simple binds on the LDAP/AD server where they are not required.
- Restrict access to the Traccar web/API port to trusted networks or a VPN.
Exploitation
- No evidence of exploitation in the wild was found at the time of writing.
- No public proof-of-concept was found.
- Not listed in CISA KEV at the time of writing.
Our recommendation
- Inventory all Traccar instances this week and identify those using LDAP.
- Patch internet-facing instances first, upgrading to 6.17.0 or later.
- Until patched, disable LDAP login and check whether the directory allows anonymous binds.
- Review recent logins, especially to administrator accounts, for signs of misuse.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password (VulnCheck) www.vulncheck.com
- Traccar commit 552c31f2097dbed9edef7cfe174c50b16febdc21 github.com
- Traccar release v6.17.0 github.com
- LdapProvider.java at v3.15 github.com
- LdapProvider.java at v6.16.0 github.com
- Traccar 6.17 release note www.traccar.org
- OffSeq threat record CVE-2026-126777 radar.offseq.com
- CVE-2026-126777 record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:21.
Original description (NVD)
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
NVD references (5)
- https://github.com/traccar/traccar/blob/v3.15/src/org/traccar/database/LdapProvider.java#L163-L169
- https://github.com/traccar/traccar/blob/v6.16.0/src/main/java/org/traccar/database/LdapProvider.java#L171-L176
- https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21
- https://github.com/traccar/traccar/releases/tag/v6.17.0
- https://www.vulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-empty-ldap-password
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.