CVE-2026-108737

Versions of Traccar through 6.16.0 are vulnerable to a weak password recovery flaw due to token purpose confusion in the TokenManager component. Because the system fails to bind tokens to a specific purpose, an attacker who obtains a leaked password reset link can reuse that token to establish a ...