← Back

CVE-2025-68930

nvd nist
Published: Feb 23, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

Affected (1)

Products: Traccar: Traccar
Traccar
1 product
Traccar
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Traccar
Up to 6.11.1

Related CWEs

CWE-1385
Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

References (1)

Source: security-advisories@github.com
ExploitMitigationVendor Advisory

Timeline

No history available yet.