What is the CVSS score of CVE-2026-26305?

CVE-2026-26305 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Mobility46.Se are affected by CVE-2026-26305?

CVE-2026-26305 exposes our WebSocket authentication mechanisms to brute-force and denial-of-service attacks due to unrestricted authentication request attempts.

How to fix or mitigate CVE-2026-26305?

Within 24 hours: Inventory all systems using WebSocket APIs and assess exposure scope; enable monitoring and alerting for authentication anomalies. Within 7 days: Implement rate limiting on authentication endpoints, deploy WAF rules to restrict login attempts, and establish incident response procedures. Within 30 days: Evaluate vendor patches or workarounds, complete remediation testing in production-like environments, and document permanent mitigation strategy.

Mobility46.Se CVE-2026-26305

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Mobility46.Se

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 01:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Mobility46.Se's WebSocket API fails to implement authentication rate limiting, enabling remote attackers to launch denial-of-service attacks against charger telemetry systems or conduct brute-force attacks to compromise accounts. The vulnerability requires no authentication or user interaction and affects all network-accessible instances. No patch is currently available.

Technical ContextAI

Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Mobility46.Se. The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.