{"schema":"threatline.record/2","record":{"id":"CVE-2026-108738","aliases":[],"summary":"Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback","details":"Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.","categories":["Unclassified"],"product":"Traccar","vendor":"Traccar","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108738","source_modified_at":"2026-10-18T11:53:06.374Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Traccar","vendor":"Traccar","versions":[{"version":"5.7","lessThanOrEqual":"6.16.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00113,"percentile":0.01378,"score_date":"2026-10-23"},"published_at":"2026-10-11T12:19:43.602Z","modified_at":"2026-10-18T11:53:06.374Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108738","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-18T11:53:06.374Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108738","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind/traccar-oidc-client-missing-state-login-csrf","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/database/OpenIdProvider.java#L110-L198","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.java#L175-L193","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/traccar/traccar","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/traccar-5.7-through-6.16.0-login-csrf-via-openid-connect-callback","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-18T11:32:23.042906Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-18T11:53:06.374Z","content_hash":"43315b1f87219005ca55624fa88117460e76dee6e2e6edf76c43fc8e99a7cc34"}}