ExploitPublished
Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
Source Exploit-DB RSS Feed
0
Severity
MediumRated by Threat Radar
Data as of 10 May 2026, 02:30 UTC
What to do
AI-suggested
Until an official fix is available, consider restricting WebSocket connections to trusted origins, implementing strict origin checks, and applying WebSocket security best practices to mitigate the risk of hijacking.
Description
Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
Indicators of compromise
Exploit source code
# Exploit Title: Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
# Date: 2026-02-26
# Exploit Author: Hazar Taspinar
# Vendor Homepage: https://www.traccar.org/
# Software Link: https://github.com/traccar/traccar
# Version: <= 6.11.1
# Tested on: Windows 11 / Linux
# CVE: CVE-2025-68930
"""
Description:
Traccar fails to validate the 'Origin' header in WebSocket connections (/api/socket).
An attacker can bypass the Same Origin Policy (SOP) by supplying a malicious Or…References
Community reviews
Loading reviews…