Vulnerability Description
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Traccar | Traccar | <= 6.11.1 |
Related Weaknesses (CWE)
References
- https://github.com/traccar/traccar/security/advisories/GHSA-ccc7-4r59-4pp7ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-25649?
CVE-2026-25649 is a vulnerability with a CVSS score of 7.3 (HIGH). Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect ...
How severe is CVE-2026-25649?
CVE-2026-25649 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25649?
Check the references section above for vendor advisories and patch information. Affected products include: Traccar Traccar.