Cross-Site WebSocket Hijacking Vulnerability in Traccar GPS Tracking System

CVE-2025-68930

What is CVE-2025-68930?

The Traccar open-source GPS tracking system is affected by a Cross-Site WebSocket Hijacking vulnerability found in its /api/socket endpoint. Due to inadequate validation of the Origin header during the WebSocket handshake process, malicious actors can circumvent the Same Origin Policy (SOP). This exploitation permits an attacker to establish a full-duplex WebSocket connection and gain access to a legitimate user's session, allowing for potential unauthorized actions or data exposure. Currently, it remains uncertain if a patch has been released to rectify this security flaw.

References