CVE-2026-26288: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

PriorityP271critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.64%

45.9th percentile

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
everon	api.everon.io	—	—

Detection & IOCsextracted from sources · hover to see the quote

domainapi.everon.io↗

→Monitor for unauthenticated WebSocket connections to OCPP endpoints — attacker connects using only a known or guessed charging station identifier with no credentials presented. ↗
→Alert on OCPP WebSocket sessions where no authentication exchange occurs before OCPP commands are issued or received — absence of an auth handshake is a strong indicator of exploitation. ↗
→Charging station identifiers (used as session keys) are publicly discoverable via web-based mapping platforms; treat any connection from an unknown source using a valid station ID as suspicious. ↗

·The affected platform (api.everon.io) was shut down by the vendor on December 1st, 2025; all versions are affected and no patch exists — only mitigation is platform decommission. ↗
·All versions of the Everon OCPP Backend are affected with no version-specific scope — any deployment of api.everon.io is vulnerable. ↗
·No known public exploitation specifically targeting this vulnerability has been reported to CISA at time of advisory publication. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.