CVE-2026-108738: 
Chainguard Análisis y mitigación de vulnerabilidades

CVE-2026-108738 is a Cross-Site Request Forgery (CSRF) vulnerability in Traccar's OpenID Connect (OIDC) authentication flow, classified as a login CSRF / authentication bypass. It affects Traccar versions 5.7 through 6.16.0 and arises because the /api/session/openid/callback endpoint never validates the OAuth state parameter, allowing an attacker to force a victim's browser to complete an OIDC login using the attacker's own authorization code. The vulnerability was published on October 11, 2026, with a CVSS v3.1 base score of 4.2 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, VulnCheck).

The root cause is CWE-352 (Cross-Site Request Forgery): the handleCallback method in OpenIdProvider.java parses the incoming authorization response and exchanges the authorization code for tokens without ever checking that the state parameter matches a value previously stored in the user's session (Traccar Source). While createAuthUri() does generate a State object and includes it in the authorization request, the callback handler in SessionResource.java at /api/session/openid/callback (GET) passes the raw query string directly to handleCallback with no state validation (Traccar SessionResource). An attacker who has a valid authorization code from their own OIDC provider account can craft a URL pointing to the victim's Traccar instance callback endpoint with that code, and if the victim's browser loads it (e.g., via a phishing link or injected iframe), the victim is silently logged into the attacker's Traccar account. Exploitation requires user interaction (the victim must load the malicious URL) and that the target Traccar instance has OpenID Connect authentication enabled (Github Advisory, HackMD Write-up).

Successful exploitation results in a "login CSRF" where the victim is authenticated into the attacker's Traccar account rather than their own. Any GPS tracking data, registered devices, geofences, or other sensitive information the victim subsequently enters or views is stored in and accessible to the attacker's account, leading to both confidentiality and integrity impacts. Availability is not directly affected, and there is no lateral movement risk beyond the Traccar application itself; however, exposure of real-time location data and fleet tracking information can have significant privacy and operational consequences (Github Advisory, VulnCheck).

As of the disclosure date (October 11, 2026), there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the attacker to have a valid account with the same OIDC provider configured on the target Traccar instance, and the victim must be induced to click a crafted link, making opportunistic mass exploitation unlikely (VulnCheck).

1. Reconnaissance: Identify a Traccar instance (versions 5.7–6.16.0) that has OpenID Connect authentication enabled. This can be confirmed by checking if the /api/session/openid/auth endpoint redirects to an OIDC provider.
2. Obtain attacker's authorization code: The attacker initiates their own OIDC login flow against the same identity provider configured on the target Traccar instance, intercepting or capturing the code parameter returned to their own callback URL before it is consumed.
3. Craft malicious callback URL: Construct a URL targeting the victim's Traccar instance callback endpoint with the attacker's authorization code, e.g., https://<victim-traccar>/api/session/openid/callback?code=<attacker_code>&state=<any_value>. Because the state parameter is never validated, any value (or none) is accepted.
4. Deliver to victim: Send the crafted URL to the victim via phishing email, social engineering, or an injected link/iframe in a page the victim is likely to visit.
5. Victim loads the URL: When the victim's browser loads the callback URL, Traccar exchanges the attacker's authorization code for tokens, retrieves the attacker's user info from the OIDC provider, and establishes a session for the attacker's Traccar account in the victim's browser.
6. Data harvesting: The victim, now logged into the attacker's account, registers their GPS devices and enters tracking data, which is stored under the attacker's account and accessible to the attacker (HackMD Write-up, Github Advisory).

• Logs: Traccar server access logs showing GET requests to /api/session/openid/callback with code parameters that do not correspond to a prior /api/session/openid/auth request from the same client IP or session; multiple callback requests with the same code value from different source IPs.
• Application Behavior: Users reporting that after clicking a link they are logged in but see unfamiliar devices, geofences, or account settings — indicating they are authenticated into a different account than their own.
• Network: Unexpected or unsolicited HTTP GET requests to /api/session/openid/callback originating from external referrers or with no prior session initiation from the same client.

Upgrade Traccar to a version newer than 6.16.0, which includes a fix that properly validates the OAuth state parameter in the OIDC callback handler (Github Advisory, VulnCheck). As an interim workaround if patching is not immediately possible, disable OpenID Connect authentication in Traccar's configuration and revert to standard username/password login. Additionally, network-level controls (e.g., restricting access to the Traccar instance to trusted networks) can reduce the attack surface by limiting the ability of attackers to deliver phishing links that reach the callback endpoint.

The vulnerability was discovered and documented by researcher "haind," who published a technical write-up on HackMD detailing the missing state validation in the OIDC callback (HackMD Write-up). VulnCheck assigned and disclosed the CVE, noting the authentication bypass nature of the flaw (VulnCheck). No significant broader media coverage or notable social media discussion has been observed beyond the initial disclosure.