Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M

CVE-2025-68930Traccar Missing Origin Validation in WebSockets

High 7.1

In plain English

A high-severity security flaw in traccar from traccar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

Affected products (as reported)

Vendor	Product	Versions
traccar	traccar	<= 6.11.1

Weakness: CWE-1385 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://github.com/traccar/traccar/security/advisories/GHSA-69x6-wcx2-vghp x_refsource_CONFIRM