CVE-2025-68930 Traccar Missing Origin Validation in WebSockets

What is CVE-2025-68930?

CVE-2025-68930 is a high-severity vulnerability in traccar, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

Weakness: CWE-1385

Which versions are affected by CVE-2025-68930?

It affects 1 product.

Products include Traccar Traccar.

How do I fix CVE-2025-68930?

No fix has been published for CVE-2025-68930 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-68930 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68930 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in traccar

• CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution Critical 9.7
• CVE-2024-7746 Use of default credentials at Traccar fleet management solution Critical 9.5
• CVE-2026-25648 Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload High 8.7
• CVE-2023-50729 An unrestricted file upload vulnerability in traccar leads to RCE High 8.5
• CVE-2020-5246 LDAP injection vulnerability in Traccar GPS Tracking System High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-69x6-wcx2-vghp.