CVE-2026-20895

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

• CWE-613

• https://ev2go.io/Product
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-04.jsonThird Party Advisory
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04Third Party Advisory, US Government Resource

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2089A vulnerability was found in SourceCodester Online Class Rec…9.8
• CVE-2026-20890Improper privilege management for some Intel(R) PROSet/Wirel…7.1
• CVE-2026-20891Improper authentication for some Intel(R) PROSet/Wireless Wi…6.3
• CVE-2026-20892Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5…8.6
• CVE-2026-20893Origin validation error issue exists in Fujitsu Security Sol…8.5
• CVE-2026-20894Cross-site scripting vulnerability exists in multiple Networ…4.8
• CVE-2026-20896Gitea Docker image versions up to and including 1.26.2 use R…9.8
• CVE-2026-20897Gitea does not properly validate repository ownership when d…9.1
• CVE-2026-20898Improper access control in the firmware for some in Alias Ch…8.5
• CVE-2026-2090A vulnerability was determined in SourceCodester Online Clas…9.8
• CVE-2026-20901Improper input validation for some Intel(R) Xeon(R) processo…4
• CVE-2026-20902An OS command injection vulnerability exists in XWEB Pro…8.8