What is the CVSS score of CVE-2026-20895?

CVE-2026-20895 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ev2go.Io are affected by CVE-2026-20895?

A high-severity vulnerability in our WebSocket backend allows attackers to hijack charging station sessions by connecting multiple endpoints with the same identifier, potentially enabling…

How to fix or mitigate CVE-2026-20895?

Within 24 hours: Identify and document all systems running the affected WebSocket backend version and restrict external access to WebSocket endpoints via network controls. Within 7 days: Implement session validation controls, enforce unique endpoint identifiers, and deploy monitoring for duplicate session connections. Within 30 days: Conduct a security audit of all WebSocket session activity, evaluate vendor patches when available, and develop a transition plan to patched versions once released.

Ev2go.Io CVE-2026-20895

HIGH

Insufficient Session Expiration (CWE-613)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Ev2go.Io

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

Session hijacking in Ev2go.Io's WebSocket backend allows remote attackers to impersonate legitimate charging stations and intercept commands due to predictable session identifiers and insufficient endpoint validation. An unauthenticated attacker can establish multiple connections with the same session ID to displace legitimate stations, potentially gaining unauthorized access to charging infrastructure or disrupting service availability. No patch is currently available.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). Affects Ev2Go.Io. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a