CVE-2026-25778

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

• CWE-613

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.jsonThird Party Advisory
• https://swtchenergy.com/contact/Product
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06Third Party Advisory, US Government Resource

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25771Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-25772Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25773** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails…6.5
• CVE-2026-25774Charging station authentication identifiers are publicly acc…5.3
• CVE-2026-25775A vulnerability in SenseLive X3050’s remote management servi…9.8
• CVE-2026-25776Movable Type provided by Six Apart Ltd. contains a code inje…9.8
• CVE-2026-25779Gitea versions up to and including 1.25.4 allow redirect byp…6.1
• CVE-2026-2578Mattermost versions 11.3.x <= 11.3.0 fail to preserve the re…4.3
• CVE-2026-25780Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.1…4.3
• CVE-2026-25781in OpenHarmony v6.0 and prior versions allow a local attacke…8.4
• CVE-2026-25782Gitea versions before 1.25.5 look up tracked-time entries by…5.3
• CVE-2026-25783Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.1…4.3