CVE-2026-108738 — Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect …
Published: 2026-10-11 · CVSS: 2.3 · CVSS 4.0
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7