CVE-2026-25649

Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints

State: Published
Severity: 7.3 High
Published: Feb 23, 2026
Updated: Feb 25, 2026
Reserved: Feb 4, 2026

Description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
traccartraccar	<= 6.11.1Affected

References

https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.