{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T23:48:44.068","vulnerabilities":[{"cve":{"id":"CVE-2025-68930","sourceIdentifier":"security-advisories@github.com","published":"2026-02-23T21:19:08.500","lastModified":"2026-02-26T16:30:45.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available."},{"lang":"es","value":"Las versiones del sistema de seguimiento GPS de código abierto Traccar hasta la 6.11.1 inclusive contienen una vulnerabilidad de Secuestro de WebSocket entre Sitios (CSWSH) en el endpoint `/api/socket`. La aplicación no valida el encabezado 'Origin' durante el handshake de WebSocket. Esto permite a un atacante remoto eludir la Política del Mismo Origen (SOP) y establecer una conexión WebSocket full-duplex utilizando las credenciales de un usuario legítimo (JSESSIONID). En el momento de la publicación, no está claro si hay una solución disponible."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-1385"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","versionEndIncluding":"6.11.1","matchCriteriaId":"76FAA1A2-2E75-4EAC-A7FA-BD790B7986A6"}]}]}],"references":[{"url":"https://github.com/traccar/traccar/security/advisories/GHSA-69x6-wcx2-vghp","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit","Mitigation"]}]}}]}