CVE-2026-27764

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

• CWE-613
• CWE-613

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-06.jsonProduct
• https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalatProduct
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06US Government Resource

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27757SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 c…7.2
• CVE-2026-27758SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 c…6.5
• CVE-2026-27759Featured Image from Content (featured-image-from-content) Wo…5.3
• CVE-2026-2776Sandbox escape due to incorrect boundary conditions in the T…10
• CVE-2026-27760OpenCATS prior to commit 3002a29 contains a PHP code injecti…9.2
• CVE-2026-27761Gitea versions up to and including 1.26.2 allow repository R…4.3
• CVE-2026-27765Improper input validation for some vLLM Hardware Plugin for …6.8
• CVE-2026-27766in OpenHarmony v6.0 and prior versions allow a local attacke…5.5
• CVE-2026-27767WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-27768SQL Injection affecting the Access Manager role.6.6
• CVE-2026-27769Mattermost versions 10.11.x <= 10.11.12 fail to validate whe…2.7
• CVE-2026-2777Privilege escalation in the Messaging System component. This…9.8