HIGHCVSS v3.1 7.4Vulnerability
CVE-2026-126777
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.4
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 7.4
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-126777
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-11-11T19:44:24+00:00
- Name
- CVE-2026-126777
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Published at
- 2026-11-11T19:17:38.497
- Last modified
- 2026-11-11T19:17:38.627
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph