CVE-2026-25711

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

• CWE-613

• https://chargemap.com/en-us/supportProduct
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.jsonThird Party Advisory
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05Third Party Advisory, US Government Resource

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25703NeuVector through 5.4.9 is can potentially leak information …7.3
• CVE-2026-25704A Privilege Dropping / Lowering Errors/Time-of-check Time-of…5.8
• CVE-2026-25705A vulnerability has been identified in [Rancher's Extensions…8.4
• CVE-2026-25707A relative path traversal bug problem when processing reposi…8.8
• CVE-2026-2571The Download Manager plugin for WordPress is vulnerable to u…4.3
• CVE-2026-25710The new upstream added a privileged D-Bus helper called plas…7
• CVE-2026-25712Gitea versions before 1.25.5 have insufficient visibility ch…7.5
• CVE-2026-25713MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vu…7.8
• CVE-2026-25714Gitea versions up to and including 1.26.1 do not apply publi…4.3
• CVE-2026-25715The web management interface of the device allows the admini…9.8
• CVE-2026-25718Gitea versions before 1.25.5 mishandle path resolution durin…9.1
• CVE-2026-25720A vulnerability exists in SenseLive X3050’s web management …5.4