CVE-2025-68930: Traccar Missing Origin Validation in WebSockets
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the /api/socket endpoint. The application fails to validate the Origin header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68930?
CVE-2025-68930 is classified as a high severity vulnerability due to its potential for allowing unauthorized access via WebSocket hijacking.
How do I fix CVE-2025-68930?
To fix CVE-2025-68930, update the Traccar GPS tracking system to version 6.11.2 or later.
What types of attacks can exploit CVE-2025-68930?
CVE-2025-68930 can be exploited for Cross-Site WebSocket Hijacking attacks, allowing attackers to hijack WebSocket connections.
Which versions of Traccar are affected by CVE-2025-68930?
CVE-2025-68930 affects all Traccar versions up to and including 6.11.1.
What is the specific vulnerability in CVE-2025-68930?
The specific vulnerability in CVE-2025-68930 is the failure to validate the 'Origin' header during the WebSocket handshake.