Traccar EUVD-2026-96903

Exploitation requires the attacker to possess a valid, unexpired password reset token/link for a target Traccar user - this is the AT:P attack requirement and implies the victim had initiated a reset and the link leaked (via HTTP referer, intercepted/forwarded email, shared URLs, or server/proxy logs). No special or non-default configuration is needed: the flaw is in Traccar's default TokenManager behavior through 6.16.0, which fails to bind tokens to a purpose, so any valid reset token is accepted at /api/session and /api/password/update. Limiting factors that reduce real-world risk: the attacker cannot proceed without first acquiring the leaked token (so the attack is opportunistic/targeted, not blind), and the token must still be within its validity window; however, once a session is minted it persists for seven days regardless of a subsequent victim-initiated reset.

This is a credible, above-average-priority authentication flaw rather than a CVSS-inflated non-issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC:H/VI:H) scores 7.6 and reflects the core problem accurately: a network-reachable, unauthenticated flaw in default behavior (TokenManager does not bind tokens to a purpose per CWE-640) that yields full account takeover - session hijack via /api/session and password change via /api/password/update, with access persisting seven days even after the victim resets. The two tempering metrics are AT:P (a specific attack requirement - the attacker must possess a valid, unexpired reset token) and UI:P (passive victim involvement, i.e. the victim must have triggered a reset whose link then leaked). No EPSS score was provided in the input and there is no CISA KEV listing, so there is no signal of mass automated exploitation; the dependency on obtaining a leaked reset link makes this better suited to targeted attacks (referer leakage, intercepted email, shared/logged URLs) than internet-wide scanning. A detailed public technical write-up (hackmd) and the VulnCheck advisory precisely locate the flaw in source, lowering the research bar for an attacker, but no explicit weaponized exploit was flagged in the input. Net: real and worth prompt patching for exposed Traccar instances, but exploitation is conditional on token acquisition rather than trivially universal.

An attacker obtains a still-valid Traccar password reset link for a target user - for example leaked via HTTP referer, a forwarded/intercepted reset email, or server/proxy logs. Because the reset token is not bound to a purpose, the attacker submits it to /api/session to mint a full authenticated session (or calls /api/password/update to set a new password), taking over the account and retaining a valid session for up to seven days even after the victim performs their own reset. No public weaponized exploit was flagged in the input, though a detailed technical write-up documenting the exact request flow is publicly available.