CVE-2026-108737: 
Chainguard Análisis y mitigación de vulnerabilidades

CVE-2026-108737 is a weak password recovery vulnerability in Traccar, an open-source GPS tracking platform, affecting all versions through 6.16.0. The flaw exists because TokenManager does not bind tokens to a specific purpose, allowing password reset tokens to be reused as full session credentials. Disclosed on October 11, 2026, it carries a CVSS v3.1 score of 6.8 (Medium) and a CVSS v4.0 score of 7.6 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). Traccar's TokenManager generates cryptographically signed JWT-like tokens containing only a user ID, a random token ID, and an expiration date — with no purpose field to distinguish a password-reset token from a session token (TokenManager source). Because SessionResource.get() accepts any valid token via GET /api/session?token=<token> and PasswordResource.update() accepts the same token via POST /api/password/update, an attacker who intercepts or obtains a password reset link can submit that token to either endpoint (SessionResource source, PasswordResource source). Tokens default to a seven-day expiration, meaning attacker access persists for up to a week even after the victim resets their password. A technical write-up is available at HackMD.

A successful exploit allows an unauthenticated attacker to fully hijack a victim's Traccar account — reading sensitive GPS tracking data, modifying account settings, and changing the account password to lock out the legitimate user. Because Traccar is used for fleet management and vehicle/asset tracking, account compromise can expose real-time and historical location data for tracked individuals, vehicles, or assets. The attacker's session persists for up to seven days regardless of any password reset performed by the victim, enabling prolonged unauthorized access (GitHub Advisory, Feedly).

As of the disclosure date (October 11, 2026), there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to first obtain a valid password reset link (e.g., via email interception, phishing, or server-side log exposure), which raises the attack complexity (GitHub Advisory).

1. Obtain a password reset link: Trigger a password reset for the target account via POST /api/password/reset with the victim's email address. Intercept the resulting reset link through email phishing, man-in-the-middle attack on unencrypted email delivery, or access to server-side logs/email infrastructure.
2. Extract the token: Parse the reset URL to extract the token parameter (a Base64URL-encoded, cryptographically signed blob containing the user ID and expiration).
3. Establish a full session (Option A): Send a GET request to /api/session?token=<extracted_token>. Because TokenManager does not enforce token purpose, the server treats the reset token as a valid session credential and returns a full authenticated session for the victim's account.
4. Change the victim's password (Option B): Send a POST request to /api/password/update with token=<extracted_token> and password=<attacker_chosen_password>, locking the victim out of their account.
5. Maintain persistent access: The token remains valid for up to seven days from issuance. Even if the victim resets their password, the attacker's existing session (obtained in step 3) continues to function until the token expires or is explicitly revoked (HackMD write-up, SessionResource source).

• Network: Unexpected GET /api/session?token=<token> requests where the token originates from a password reset flow (i.e., the same token value appears in both a /api/password/reset email and a subsequent session request); requests to /api/password/update from IP addresses not associated with the account owner.
• Logs: Traccar access logs showing a password reset token used to authenticate a session (GET /api/session) from an IP address different from the one that originally requested the reset; multiple API calls using the same token value across different endpoints.
• Application Behavior: Account password changed without the legitimate user initiating the change; user locked out of their account shortly after receiving a password reset email; active sessions appearing from unexpected geographic locations or IP addresses.

Update Traccar to a version newer than 6.16.0, which addresses the token purpose confusion issue (GitHub Advisory). As a configuration-level workaround, administrators should ensure that password reset emails are delivered over encrypted channels (TLS) to reduce interception risk, and should monitor API logs for anomalous token usage patterns. Additionally, consider implementing shorter token expiration windows and ensuring all existing tokens are invalidated upon a successful password reset (Feedly). The VulnCheck advisory recommends implementing token binding mechanisms so reset tokens can only be used for their intended purpose (VulnCheck Advisory).

The vulnerability was assigned and disclosed by VulnCheck on October 11, 2026, and published to the GitHub Advisory Database the same day (GitHub Advisory). A technical write-up by the researcher (@haind) detailing the token purpose confusion issue is available on HackMD (HackMD write-up). No significant broader media coverage or notable community reactions have been identified at this time.