CVE-2026-25649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25649", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-04T05:15:41.792Z", "datePublished": "2026-02-23T21:12:06.040Z", "dateUpdated": "2026-02-25T15:20:54.780Z"}, "containers": {"cna": {"title": "Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7"}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"version": "<= 6.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T21:12:06.040Z"}, "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available."}], "source": {"advisory": "GHSA-ccc7-4r59-4pp7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:20:25.793234Z", "id": "CVE-2026-25649", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:20:54.780Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25649", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-04T05:15:41.792Z", "datePublished": "2026-02-23T21:12:06.040Z", "dateUpdated": "2026-02-25T15:20:54.780Z"}, "containers": {"cna": {"title": "Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7"}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"version": "<= 6.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T21:12:06.040Z"}, "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available."}], "source": {"advisory": "GHSA-ccc7-4r59-4pp7", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25649", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T15:20:25.793234Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:20:46.844Z"}}]}}

{"affected": [{"affectedData": [{"product": "traccar", "vendor": "traccar", "versions": [{"status": "affected", "version": "<= 6.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*", "matchCriteriaId": "76FAA1A2-2E75-4EAC-A7FA-BD790B7986A6", "versionEndIncluding": "6.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available."}, {"lang": "es", "value": "Las versiones del sistema de seguimiento GPS de c\u00f3digo abierto Traccar hasta la 6.11.1 inclusive contienen un problema en el que usuarios autenticados pueden robar c\u00f3digos de autorizaci\u00f3n de OAuth 2.0 al explotar una vulnerabilidad de redirecci\u00f3n abierta en dos endpoints relacionados con OIDC. El par\u00e1metro 'redirect_uri' no se valida contra una lista blanca, permitiendo a los atacantes redirigir c\u00f3digos de autorizaci\u00f3n a URL controladas por el atacante, lo que permite la toma de control de cuentas en cualquier aplicaci\u00f3n integrada con OAuth. Al momento de la publicaci\u00f3n, no est\u00e1 claro si hay una soluci\u00f3n disponible."}], "id": "CVE-2026-25649", "lastModified": "2026-06-17T10:25:00.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25649", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:20:25.793234Z", "version": "2.0.3"}}]}, "published": "2026-02-23T22:16:24.927", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traccar", "source": "cna", "vendor": "traccar"}, "product": "traccar", "vendor": "traccar"}], "analysis": {"en": {"generated_at": "2026-04-17T16:12:51.459475+00:00", "value": {"mitigation_remediation": ["If your Traccar deployment uses OAuth\u00a02.0, immediately suspend or disable OIDC endpoints until an official patch is available.", "Configure the server to allow only trusted redirect_uri values by implementing a strict whitelist for OIDC redirect endpoints.", "Apply any Traccar update that addresses the flaw as soon as it becomes available."], "summary": {"action": "Assess Impact", "impact": "Unauthorized Account Takeover via Auth Code Theft"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Traccar open\u2011source GPS tracking platform up to and including version\u00a06.11.1. No specific patch has been published at the time of this advisory, and the CVE lists no workaround from the vendor.", "description_and_impact": "Authenticated users of the Traccar GPS tracking system can steal OAuth\u00a02.0 authorization codes. Two OIDC\u2011related endpoints fail to validate the redirect_uri parameter against a whitelist, allowing attackers to redirect the authorization code to an attacker\u2011controlled URL. The stolen code can then be exchanged for access tokens, enabling full takeover of any account that uses OAuth integration.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high potential for damage, yet the EPSS score is below 1\u202f%, suggesting that exploitation is currently unlikely. The advisory is not listed in CISA\u2019s KEV catalog. Attackers would exploit the flaw by interacting with the vulnerable OIDC endpoints over the network, supplying an arbitrary redirect_uri. Successful exploitation results in the attacker gaining the victim\u2019s access tokens and thereby full control of the victim\u2019s Traccar account and any downstream services that rely on OAuth authentication."}}}}, "created": "2026-02-24T09:54:47.960191+00:00", "updated": "2026-04-17T16:15:22.652525+00:00", "vendors": ["traccar", "traccar$PRODUCT$traccar"]}