CVE-2026-126777

Traccar version 3.15 before 6.17.0 is vulnerable to an authentication bypass in the LdapProvider.login() function. The root cause is a failure to reject empty passwords when LDAP authentication is enabled, allowing the system to perform unauthenticated binds against directories that permit them. ...