What is the CVSS score of CVE-2025-68930?

CVE-2025-68930 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Traccar are affected by CVE-2025-68930?

Traccar GPS tracking systems up to version 6.11.1 are vulnerable to Cross-Site WebSocket Hijacking attacks, allowing attackers to hijack user sessions and gain unauthorized access to real-time…

Is there a public PoC exploit available for CVE-2025-68930?

Yes, a public proof-of-concept exploit is available for CVE-2025-68930. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-68930?

Within 24 hours: Inventory all Traccar deployments and document version numbers; assess whether systems are internet-facing or restricted to internal networks. Within 7 days: Implement network segmentation to restrict WebSocket endpoint access; deploy WAF rules to enforce strict Origin header validation for `/api/socket` endpoint; disable WebSocket functionality if not operationally required. Within 30 days: Evaluate upgrade path to patched versions when available; consider migrating to alternative GPS tracking solutions if patch timeline is unacceptable; conduct forensic review of access logs for exploitation evidence.

Traccar CVE-2025-68930

HIGH

Missing Origin Validation in WebSockets (CWE-1385)

2026-02-23 security-advisories@github.com

Authentication Bypass Traccar

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:30 vuln.today

Public exploit code

CVE Published

Feb 23, 2026 - 21:19 nvd

HIGH 7.1

DescriptionGitHub Advisory

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the /api/socket endpoint. The application fails to validate the Origin header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

AnalysisAI

Technical ContextAI

Affects Traccar. Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the /api/socket endpoint. The application fails to validate the Origin header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available