What is the CVSS score of CVE-2026-27647?

CVE-2026-27647 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mobility46.Se are affected by CVE-2026-27647?

A HIGH severity vulnerability in WebSocket session management allows attackers to hijack charging station connections by reusing session identifiers across multiple endpoints, potentially enabling…

How to fix or mitigate CVE-2026-27647?

Within 24 hours: Identify all systems running affected WebSocket backends and isolate them from untrusted networks; enable enhanced logging on all WebSocket connections. Within 7 days: Implement network segmentation to restrict WebSocket endpoint access to authorized sources only; deploy WAF rules to detect and block suspicious multi-endpoint session reuse patterns. Within 30 days: Develop custom input validation to reject duplicate session identifiers; establish vendor communication cadence for patch availability; conduct penetration testing to validate compensating controls.

Mobility46.Se CVE-2026-27647

HIGH

Insufficient Session Expiration (CWE-613)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Mobility46.Se

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 01:16 nvd

HIGH 7.3

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

Mobility46.Se's WebSocket implementation allows multiple connections to share predictable session identifiers, enabling attackers to intercept and hijack active charging station sessions without authentication. An attacker can impersonate legitimate stations to execute arbitrary backend commands, intercept communications, or launch denial-of-service attacks by flooding the service with valid session requests. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). Affects Mobility46.Se. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a