Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

published 2026-06-16 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-37510

cvss: 9.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent configuration with no confirmation, notification, or visual indication. A single crafted link delivered via SMS, email, a webpage, or any installed app can therefore reconfigure the app the moment the victim taps it, with no special permissions required. As a result, an attacker can covertly redirect all of the victim's GPS telemetry to their own server at maximum precision and frequency, and the change persists across restarts. This gives the attacker continuous, real-time tracking of the victim's location. This issue has been fixed in version 9.7.20.

Patch / fix

links 1

github.com/traccar/traccar-client@23558b0 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-17)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/traccar/traccar-client/security/advisories/GHSA-vm6j-6g39-gj97 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

traccar traccar-client

Classification

Weakness

CWE-940 Improper Verification of Source of a Communication Channel

References

Sources

CVE List CVE-2026-48745
NVD CVE-2026-48745

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary