CVE-2026-108738

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

PT-2026-110141

Name of the Vulnerable Software and Affected Versions Traccar versions 5.7 through 6.16.0 Description A cross-site request forgery issue exists where the OpenID Connect callback fails to validate the OAuth state parameter. This allows an attacker to force a victim to log into an account controlle...