How to fix CVE-2025-68930?

Within 24 hours: Inventory all Traccar deployments and document version numbers; assess whether systems are internet-facing or restricted to internal networks. Within 7 days: Implement network segmentation to restrict WebSocket endpoint access; deploy WAF rules to enforce strict Origin header validation for `/api/socket` endpoint; disable WebSocket functionality if not operationally required. Within 30 days: Evaluate upgrade path to patched versions when available; consider migrating to alternative GPS tracking solutions if patch timeline is unacceptable; conduct forensic review of access logs for exploitation evidence.

Is Traccar affected by CVE-2025-68930?

Traccar GPS tracking systems up to version 6.11.1 are vulnerable to Cross-Site WebSocket Hijacking attacks, allowing attackers to hijack user sessions and gain unauthorized access to real-time location data.

CVE-2025-68930

HIGH

2026-02-23 [email protected]

7.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:30 vuln.today

Public exploit code

CVE Published

Feb 23, 2026 - 21:19 nvd

HIGH 7.1

Description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

Analysis

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the /api/socket endpoint. The application fails to validate the Origin header during the WebSocket handshake. [CVSS 7.1 HIGH]

Technical Context

Affects Traccar. Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available

Affected Products

Vendor: Traccar. Product: Traccar.

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +36

POC: +20

CVE-2025-68930 vulnerability details – vuln.today

Back

CVE-2025-68930

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-68930

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code