CVE-2026-108737 Details

A vulnerability in Traccar versions through 6.16.0 allows for weak password recovery mechanisms. The issue arises because the TokenManager does not associate password reset tokens with a specific purpose. As a result, attackers can reuse these tokens as session credentials. When a reset token is leaked, it can be used to gain full session access via the /api/session endpoint or to change passwords through the /api/password/update endpoint. This unauthorized access persists for seven days, even after the victim has reset their password.

The vulnerability can be addressed by modifying the TokenManager to include a purpose claim in the token payload, enforcing purpose checks at the password update and session endpoints, revoking reset tokens after use, and shortening the lifetime of reset tokens.