An open redirect vulnerability in Traccar versions 6.11.1 and earlier allows authenticated attackers to perform account takeovers via OAuth 2.0 authorization code theft.

This vulnerability involves an open redirect flaw (CWE-601) in two OIDC-related endpoints where the redirect_uri parameter lacks proper whitelist validation. An authenticated user can leverage this to redirect authorization codes to an attacker-controlled URL, facilitating unauthorized account access.

The ability for an attacker to intercept OAuth 2.0 authorization codes directly leads to the potential for full account takeover of integrated services. Given the CVSS score of 7.3, this represents a high-severity risk to user identity and data privacy, particularly for organizations relying on Traccar for sensitive fleet management or tracking data.

Immediate Action: Monitor the official Traccar GitHub repository and security advisories for the release of a patch, as no fix is currently confirmed to be available.

Proactive Monitoring: Review web server and application logs for unusual redirects or requests involving OIDC-related endpoints that point to external or suspicious domains.

Compensating Controls: Implement strict egress filtering on the network and utilize a Web Application Firewall to block requests containing suspicious or non-whitelisted redirect_uri parameters.

Public Exploit Available: Unknown

The risk of account takeover via OIDC flow manipulation is significant for any deployment using OAuth 2.0 integration. Administrators should restrict access to the affected OIDC features until a vendor-supplied patch is released and verified. Prioritize the audit of all authenticated users to identify potentially compromised accounts if suspicious activity is detected.