Our car was stolden. My son phone was left in it we don’t have. The password to iCloud act how can we. Track the device

See here for information on how to track the devise - https://support.apple.com/en-gb/HT210515

Without the iCloud password I do not believe that you can track the phone, however see here on how to reset your iCloud password - https://support.apple.com/en-gb/HT201487

Once you have reseted the password, you should be able to track type phone.

All the best

Surely if they reset the iCloud password from another devise then they could access find my iPhone?

Apple does not get involved with lost or stollen devices.

Ask your carrier to blacklist it so others can only use it for parts.

No.