Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled… (CVE-2026-108738)

The vulnerability in Traccar 5.7 through 6.16.0 arises because the OpenID Connect callback endpoint (/api/session/openid/callback) does not validate the OAuth state parameter, which is intended to prevent CSRF attacks. Attackers can exploit this by inducing victims to load the callback URL with an attacker-supplied authorization code, causing the victim's session data to be linked to the attacker's account. This can lead to unauthorized data association and potential privacy issues.

The impact is limited to the victim being logged into an attacker-controlled account, which may cause victim data such as registered devices to be stored or associated with the attacker. The CVSS score is 4.2 (low severity), indicating limited confidentiality and integrity impact with no availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about unsolicited links that might trigger the OpenID Connect callback. No official fix or patch links are provided in the current data.