VYPR
← All advisories
High severity7.1NVD Advisory· Published Feb 23, 2026· Updated Jun 17, 2026

CVE-2025-68930

CVE-2025-68930

Description

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the /api/socket endpoint. The application fails to validate the Origin header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Traccar/Traccar3 versions
    cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*range: <=6.11.1
    • (no CPE)range: <=6.11.1
    • (no CPE)range: <= 6.11.1
  • GitHub/traccarllm-create
    Range: <=6.11.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.