Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108738Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Medium 4.2

In plain English

A medium-severity cross-site request forgery in Traccar from Traccar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.1%top 98.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.

Affected products (as reported)

Vendor	Product	Versions
Traccar	Traccar	5.7 – through 6.16.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://hackmd.io/@haind/traccar-oidc-client-missing-state-login-csrf third-party-advisory
https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/database/OpenIdProvider.java#L110-L198 technical-description
https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.java#L175-L193 technical-description
https://github.com/traccar/traccar product
VulnCheck Advisory: Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback third-party-advisory