CVE-2026-27764
published 2026-03-06CVE-2026-27764: The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session…
PriorityP348high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.29%
21.1th percentile
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mobiliti | e-mobi.hu | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Mobiliti e-mobi.hu
cisa_ics·2026-03-03·CVSS 9.4
[CRITICAL] Mobiliti e-mobi.hu
ICS Advisory
##
Mobiliti e-mobi.hu
Release DateMarch 03, 2026
Alert CodeICSA-26-062-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
The following versions of Mobiliti e-mobi.hu are affected:
- e-mobi.hu vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| Mobiliti
| Mobiliti e-mobi.hu
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials
## Background
- C
VulDB
Mobiliti e-mobi.hu WebSocket Backend session expiration
vuldb·2026-05-05·CVSS 6.9
CVE-2026-27764 [MEDIUM] Mobiliti e-mobi.hu WebSocket Backend session expiration
A vulnerability, which was classified as critical, has been found in Mobiliti e-mobi.hu. Impacted is an unknown function of the component WebSocket Backend. Performing a manipulation results in session expiration.
This vulnerability is reported as CVE-2026-27764. The attack is possible to be carried out remotely. No exploit exists.
GHSA
GHSA-26xr-j83g-4fmm: The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session
ghsa_unreviewed·2026-03-06
CVE-2026-27764 [MEDIUM] CWE-613 GHSA-26xr-j83g-4fmm: The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-06
Published