CVE-2026-25649

Katalog CVE

CVSS 8.7 · High EPSS 0,19%

Kerentanan Cross-Site Request Forgery (CSRF) pada traccar. Skor CVSS 3.1 8.7 (High) menurut NVD.

Deskripsi (NVD)

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.

Rincian

Terbit di NVD

23 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7 exploit · mitigasi · advisory vendor