traccar traccar-client up to 9.7.19 verification of source

Summaryinfo

A vulnerability has been found in traccar traccar-client up to 9.7.19 and classified as critical. This impacts an unknown function. This manipulation causes verification of source. The identification of this vulnerability is CVE-2026-48745. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in traccar traccar-client up to 9.7.19 and classified as critical. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a verification of source vulnerability. The CWE definition for the vulnerability is CWE-940. The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent configuration with no confirmation, notification, or visual indication. A single crafted link delivered via SMS, email, a webpage, or any installed app can therefore reconfigure the app the moment the victim taps it, with no special permissions required. As a result, an attacker can covertly redirect all of the victim's GPS telemetry to their own server at maximum precision and frequency, and the change persists across restarts. This gives the attacker continuous, real-time tracking of the victim's location. This issue has been fixed in version 9.7.20.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-48745 since 05/22/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 9.7.20 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• traccar

Name

• traccar-client

Version

• 9.7.0
• 9.7.1
• 9.7.2
• 9.7.3
• 9.7.4
• 9.7.5
• 9.7.6
• 9.7.7
• 9.7.8
• 9.7.9
• 9.7.10
• 9.7.11
• 9.7.12
• 9.7.13
• 9.7.14
• 9.7.15
• 9.7.16
• 9.7.17
• 9.7.18
• 9.7.19

Website

• Product: https://github.com/traccar/traccar-client/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion