CVE-2026-20748

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

• CWE-613
• CWE-613

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-08.jsonProduct
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-08US Government Resource

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20741Improper access control for some Intel(R) PROSet/Wireless Wi…8.3
• CVE-2026-20742An OS command injection vulnerability exists in XWEB Pro v…8.8
• CVE-2026-20744The charging station websocket endpoint accepts connections …9.8
• CVE-2026-20745Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi S…7.1
• CVE-2026-20746Virtual attribute handling in Ping Identity PingDirectory in…6.3
• CVE-2026-20747Improper conditions check for some Intel(R) PROSet/Wireless …7.1
• CVE-2026-20749Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi So…7.2
• CVE-2026-2075A security flaw has been discovered in yeqifu warehouse up t…8.8
• CVE-2026-20750Gitea does not properly validate project ownership in organi…9.1
• CVE-2026-20751Out-of-bounds read for the Intel(R) Data Center Graphics Dri…8.3
• CVE-2026-20752Improper authentication for some Intel(R) PROSet/Wireless Wi…6.7
• CVE-2026-20753Integer overflow in the UEFI firmware for the Slim Bootloade…8.7