Is CVE-2026-108737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108737 being exploited in the wild.

How severe is CVE-2026-108737?

Medium severity, with a CVSS score of 6.8, published 11 October 2026.

Is there a fix for CVE-2026-108737?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108737 attacked?

It is attacked over the network.

Am I affected by CVE-2026-108737?

Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108737: Traccar password recovery token misuse vulnerability

CVE-2026-108737 · Severity: medium · CVSS 6.8 · Published 2026-10-11

Traccar is an open-source GPS tracking platform. The password recovery system generates tokens that can be reused by attackers to create valid sessions or change passwords without authorization, even if the victim has already reset their password. An attacker with a leaked password-reset link can maintain access to accounts for up to seven days.

Technologies: Traccar. Vendors: Traccar.

Quick answers

Is CVE-2026-108737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108737 being exploited in the wild.
How severe is CVE-2026-108737?: Medium severity, with a CVSS score of 6.8, published 11 October 2026.
Which products and versions are affected?: Traccar through 6.16.0.
Is there a fix for CVE-2026-108737?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108737 attacked?: It is attacked over the network.
Am I affected by CVE-2026-108737?: Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The TokenManager does not bind password-reset tokens to their intended purpose, allowing an attacker to submit a reset token directly to the /api/session endpoint to obtain a valid session, or to /api/password/update to change the user's password. The vulnerability affects the token verification logic in PasswordResource, which extracts the user ID from the token without checking whether the token was issued for password reset specifically.

Affected products

Traccar Traccar through 6.16.0

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.