PT-2026-21566 · Traccar · Traccar

Djvirus9 · Published 2026-02-23 · Updated 2026-02-28 · CVE-2026-25649

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar versions up to and including 6.11.1

Description The Traccar open-source GPS tracking system is affected by an issue where authenticated users can obtain OAuth 2.0 authorization codes through an open redirect flaw in two OpenID Connect (OIDC)-related endpoints. The redirect uri parameter is not properly validated against a whitelist, allowing attackers to redirect authorization codes to URLs under their control. This can lead to account takeover on any application integrated with OAuth.

Recommendations Versions up to and including 6.11.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Open Redirect

Weakness Enumeration

CWE-352

CWE-601

Related Identifiers

CVE-2026-25649

GHSA-CCC7-4R59-4PP7

Affected Products

Traccar

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25649.json · Exploit
• https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25649 · Security Note
• https://t.me/CVEtracker/45527 · Telegram Post
• https://t.me/cveNotify/153321 · Telegram Post
• https://twitter.com/cracbot/status/2027700416855883867 · Twitter Post
• https://twitter.com/cracbot/status/2027338117146124718 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026112891632460242 · Twitter Post
• https://twitter.com/CVEnew/status/2026184685353861391 · Twitter Post