{"metadata": {"vulnerability": "cve-2026-108738", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-10T00:00:00Z", "date_only": false, "value": "2026-10-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108738", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-11T01:52:54.368Z", "date_only": false, "value": "2026-10-11T01:52:54.368Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-108738", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T12:19:43.602Z", "date_only": false, "value": "2026-10-11T12:19:43.602Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-108738", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T12:19:43.602Z", "date_only": false, "value": "2026-10-11T12:19:43.602Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108738", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T12:56:06.672Z", "date_only": false, "value": "2026-10-11T12:56:06.672864Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117422382505769624", "record": "CVE-2026-108738", "field": "creation_timestamp", "uuid": "bd7e38ce-0490-48a4-aed2-5d502a8d1531", "content": "CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108738https://hackmd.io/@haind/traccar-oidc-client-missing-state-login-csrfhttps://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/database/OpenIdProvider.java#L110-L198https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.java#L175-L193https://github.com/traccar/traccarhttps://www.vulncheck.com/advisories/traccar-5.7-through-6.16.0-login-csrf-via-openid-connect-callback#Traccar#CVE_2026_108738#bot", "url": "https://infosec.exchange/users/cve/statuses/117422382505769624"}, {"timestamp": "2026-10-11T13:17:18Z", "date_only": false, "value": "2026-10-11T13:17:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JF89-8GJP-J4C9", "record": "GHSA-JF89-8GJP-J4C9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-11T13:17:18.220Z", "date_only": false, "value": "2026-10-11T13:17:18.220", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108738", "record": "FKIE_CVE-2026-108738", "field": "published"}, {"timestamp": "2026-10-11T15:31:05Z", "date_only": false, "value": "2026-10-11T15:31:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JF89-8GJP-J4C9", "record": "GHSA-JF89-8GJP-J4C9", "field": "published"}, {"timestamp": "2026-10-11T15:31:05Z", "date_only": false, "value": "2026-10-11T15:31:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JF89-8GJP-J4C9", "record": "GHSA-JF89-8GJP-J4C9", "field": "modified"}, {"timestamp": "2026-10-18T11:32:23.042Z", "date_only": false, "value": "2026-10-18T11:32:23.042906Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108738", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:32:23.042Z", "date_only": false, "value": "2026-10-18T11:32:23.042906Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108738", "record": "FKIE_CVE-2026-108738", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:53:06.374Z", "date_only": false, "value": "2026-10-18T11:53:06.374Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-108738", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:53:06.374Z", "date_only": false, "value": "2026-10-18T11:53:06.374Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108738", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-18T12:17:00.887Z", "date_only": false, "value": "2026-10-18T12:17:00.887", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108738", "record": "FKIE_CVE-2026-108738", "field": "lastModified"}]}