Threats affecting pkg:github/Traccar

Traccar versions from 3.15 up to but not including 6.17.0 have an authentication bypass vulnerability in the LDAP authentication mechanism. The LdapProvider.login() method does not reject empty passwords, allowing unauthenticated LDAP binds when LDAP authentication is enabled. Attackers who know a valid username can log in without a password via API or HTTP Basic authentication if the LDAP directory permits unauthenticated binds, potentially gaining access to any account, including administrators. This vulnerability is fixed in version 6.17.0.