A Cross-Site WebSocket Hijacking vulnerability in Traccar versions 6.11.1 and earlier allows remote, unauthenticated attackers to hijack user sessions via the /api/socket endpoint.

The application fails to perform necessary validation of the Origin header during the WebSocket handshake process. This flaw allows an unauthenticated attacker to bypass the Same Origin Policy and establish unauthorized WebSocket connections using the credentials of a legitimate user.

Successful exploitation of this vulnerability allows an attacker to interact with the GPS tracking system as if they were an authenticated user. This could lead to unauthorized access to sensitive location data, device management functions, and user information, posing a significant risk to privacy and operational security. With a CVSS score of 7.1, this is a High severity issue that requires immediate attention to prevent potential data exfiltration or system manipulation.

Immediate Action: Monitor the official Traccar GitHub repository for the release of a patched version and apply it immediately upon availability.

Proactive Monitoring: Review web server access logs for anomalous WebSocket handshake requests or suspicious Origin header values originating from unknown domains.

Compensating Controls: Implement strict CORS policies or WAF rules that explicitly validate or restrict the Origin header for all requests directed to the /api/socket endpoint.

Public Exploit Available: Yes — an ExploitDB entry exists.

The presence of a public exploit for this High severity vulnerability necessitates prompt action. Organizations should prioritize identifying all instances of the Traccar software and prepare for a rapid deployment of the security update as soon as the vendor provides a fix. Until a patch is applied, administrators should restrict access to the application via network-level controls to reduce the attack surface.