CVE-2025-68140

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

• CWE-863

• https://github.com/EVerest/everest-core/security/advisories/GHSA-w385-3jwp-x47xVendor Advisory

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68135EVerest is an EV charging software stack. Prior to version 2…6.5
• CVE-2025-68136EVerest is an EV charging software stack. Prior to version 2…7.4
• CVE-2025-68137EVerest is an EV charging software stack. Prior to version 2…8.3
• CVE-2025-68138EVerest is an EV charging software stack, and EVerest libocp…4.7
• CVE-2025-68139EVerest is an EV charging software stack. In all versions up…4.3
• CVE-2025-6814The Booking X plugin for WordPress is vulnerable to unauthor…7.5
• CVE-2025-68141EVerest is an EV charging software stack. Prior to version 2…7.4
• CVE-2025-68142PyMdown Extensions is a set of extensions for the `Python-Ma…5.3
• CVE-2025-68143Model Context Protocol Servers is a collection of reference …8.8
• CVE-2025-68144In mcp-server-git versions prior to 2025.12.17, the git_diff…7.1
• CVE-2025-68145In mcp-server-git versions prior to 2025.12.17, when the ser…9.1
• CVE-2025-68146filelock is a platform-independent file lock for Python. In …6.5