Authenticated users of the Traccar GPS tracking system can steal OAuth 2.0 authorization codes. Two OIDC‑related endpoints fail to validate the redirect_uri parameter against a whitelist, allowing attackers to redirect the authorization code to an attacker‑controlled URL. The stolen code can then be exchanged for access tokens, enabling full takeover of any account that uses OAuth integration.

The vulnerability affects all releases of the Traccar open‑source GPS tracking platform up to and including version 6.11.1. No specific patch has been published at the time of this advisory, and the CVE lists no workaround from the vendor.

The CVSS score of 7.3 indicates a high potential for damage, yet the EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The advisory is not listed in CISA’s KEV catalog. Attackers would exploit the flaw by interacting with the vulnerable OIDC endpoints over the network, supplying an arbitrary redirect_uri. Successful exploitation results in the attacker gaining the victim’s access tokens and thereby full control of the victim’s Traccar account and any downstream services that rely on OAuth authentication.