What is the CVSS score of CVE-2026-20792?

CVE-2026-20792 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chargemap.Com are affected by CVE-2026-20792?

CVE-2026-20792 allows attackers to perform unlimited authentication requests against WebSocket endpoints, enabling credential brute-force attacks and denial-of-service conditions that could…

How to fix or mitigate CVE-2026-20792?

Within 24 hours: Identify all systems using vulnerable WebSocket implementations and assess exposure scope. Within 7 days: Deploy WAF rules to rate-limit authentication requests per IP/session and implement CAPTCHA challenges after failed attempts; enable enhanced logging of authentication failures. Within 30 days: Evaluate vendor patch availability, test and deploy when released; consider disabling WebSocket authentication if business-critical alternative exists, or implement network segmentation to restrict WebSocket access to trusted networks only.

Chargemap.Com CVE-2026-20792

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Chargemap.Com

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Chargemap.Com's WebSocket API lacks authentication rate limiting, enabling attackers to launch denial-of-service attacks that disrupt charger telemetry or conduct brute-force credential attacks against user accounts. The vulnerability affects all users of the platform and currently has no available patch. With a CVSS score of 7.5 and minimal exploit prerequisites (no authentication or user interaction required), this represents a significant availability risk.

Technical ContextAI

Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Chargemap.Com. The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.