PT-2026-21566 · Traccar · Traccar

Djvirus9 · Publicado 2026-02-23 · Atualizado 2026-02-28 · CVE-2026-25649

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar versions up to and including 6.11.1

Description The Traccar open-source GPS tracking system is affected by an issue where authenticated users can obtain OAuth 2.0 authorization codes through an open redirect flaw in two OpenID Connect (OIDC)-related endpoints. The redirect uri parameter is not properly validated against a whitelist, allowing attackers to redirect authorization codes to URLs under their control. This can lead to account takeover on any application integrated with OAuth.

Recommendations Versions up to and including 6.11.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Open Redirect

Enumeração de Fraquezas

CWE-352

CWE-601

Identificadores relacionados

CVE-2026-25649

GHSA-CCC7-4R59-4PP7

Produtos afetados

Traccar

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25649.json · Exploit
• https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25649 · Aviso do Fabricante
• https://t.me/CVEtracker/45527 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25649 · Nota de Segurança
• https://t.me/cveNotify/153321 · Publicação no Telegram
• https://twitter.com/cracbot/status/2027700416855883867 · Publicação no Twitter
• https://twitter.com/cracbot/status/2027338117146124718 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026112891632460242 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026184685353861391 · Publicação no Twitter