Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials… (CVE-2026-108737)

Traccar through version 6.16.0 contains a weak password recovery vulnerability (CVE-2026-108737) due to the TokenManager not binding password reset tokens to their intended purpose. This allows attackers who obtain a leaked reset link to reuse the token as a session credential via the /api/session endpoint or to change the victim's password via /api/password/update. The vulnerability enables attackers to retain access for seven days despite the victim resetting their password. The CVSS 3.1 score is 6.8 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact without availability impact.

Attackers who obtain a leaked password reset link can reuse the reset token to gain full session access or change the victim's password, maintaining unauthorized access for up to seven days even after the victim resets their password. This compromises confidentiality and integrity of the victim's account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to password reset links and monitor for suspicious activity related to password recovery. Avoid sharing reset links and consider implementing additional verification steps for password resets.