CVE-2025-68930 - CVE House
Back to Database
Status published High CVE-2025-68930

Traccar Missing Origin Validation in WebSockets

Vulnerability Description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68930

Credits & Attribution

No credits recorded in the NVD database.

References

More from traccar

View All →
CVE-2025-61666
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
High 8.7
CVE-2024-31214
Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
Critical 9.7
CVE-2024-24809
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
High 8.5
CVE-2023-50729
An unrestricted file upload vulnerability in traccar leads to RCE
High 8.5
CVE-2021-21292
Unquoted Windows binary path in Traccar
Medium 5.5

Affected Vendor

Affected Software

traccar
Vulnerable Versions:
<= 6.11.1

Timeline

Official Publish: February 23rd, 2026
Last Modified: February 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-1385

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.