What is the CVSS score of CVE-2026-26290?

CVE-2026-26290 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ev.Energy are affected by CVE-2026-26290?

A high-severity vulnerability in the WebSocket backend allows attackers to hijack charging station sessions by connecting multiple endpoints with identical session identifiers, potentially enabling…

How to fix or mitigate CVE-2026-26290?

Within 24 hours: Inventory all affected charging stations and document current session management practices; implement network monitoring for suspicious WebSocket connection patterns. Within 7 days: Deploy compensating controls (see below), restrict WebSocket access to trusted networks only, and brief incident response teams. Within 30 days: Establish a vendor communication cadence for patch availability; conduct full security assessment of WebSocket architecture and consider alternative session validation mechanisms.

Ev.Energy CVE-2026-26290

HIGH

Insufficient Session Expiration (CWE-613)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Ev.Energy

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 01:16 nvd

HIGH 7.3

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

Ev.Energy's WebSocket implementation accepts duplicate session identifiers from multiple endpoints, allowing attackers to hijack active charging station sessions through predictable identifier prediction. An unauthenticated remote attacker can impersonate legitimate stations to intercept commands, authenticate as other users, or disrupt service by flooding the backend with spoofed session requests. No patch is currently available.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). Affects Ev.Energy. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a