CVE-2025-68930

🗓️ 23 Feb 2026 20:44:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Traccar up to 6.11.1 has CSWSH from missing Origin validation on /api/socket, enabling a WebSocket with a user's JSESSIONID.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for CVE-2025-68930	4 May 202616:29	–	githubexploit
Circl	CVE-2025-68930	23 Feb 202621:27	–	circl
CNNVD	Traccar 安全漏洞	23 Feb 202600:00	–	cnnvd
Cvelist	CVE-2025-68930 Traccar Missing Origin Validation in WebSockets	23 Feb 202620:44	–	cvelist
Exploit DB	Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)	4 May 202600:00	–	exploitdb
NVD	CVE-2025-68930	23 Feb 202621:19	–	nvd
OSV	CVE-2025-68930 Traccar Missing Origin Validation in WebSockets	23 Feb 202620:44	–	osv
Packet Storm	📄 Traccar GPS Tracking System 6.11.1 Cross-Site WebSocket Hijacking	5 May 202600:00	–	packetstorm
Positive Technologies	PT-2026-21550	23 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-68930	24 Feb 202622:30	–	redhatcve

NVD

Vulners

Node

traccar traccarRange≤6.11.1

[
  {
    "vendor": "traccar",
    "product": "traccar",
    "versions": [
      {
        "version": "<= 6.11.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/traccar/traccar/security/advisories/GHSA-69x6-wcx2-vghp

Parameter	Position	Path	Description	CWE
Origin	header	/api/socket	WebSocket handshake vulnerability due to Origin header bypass allowing CSWSH on /api/socket	CWE-1385
Cookie: JSESSIONID	header	/api/socket	WebSocket handshake vulnerability due to Origin header bypass allowing CSWSH on /api/socket	CWE-1385

17 Jun 2026 09:59Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.5 - 7.1

EPSS0.00541

CWE-1385