Threats tagged 'ghsa-fjf2-ffvm-qw56'

Traccar versions from 3.15 up to but not including 6.17.0 contain an authentication bypass vulnerability in the LdapProvider.login() function. This flaw allows unauthenticated attackers who know a valid username to log in with an empty password if the LDAP directory permits unauthenticated binds. This can lead to unauthorized access to any account, including administrator accounts.