CVE-2026-126777

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...