CVE-2026-20748

CVE-2026-20748 is a session hijacking and shadowing vulnerability in WebSocket backends that utilize predictable charging station identifiers for session association, specifically affecting Everon OCPP Backends. This allows multiple endpoints to connect with the same identifier, enabling an attacker to displace legitimate stations and intercept backend commands. With a CVSS score of 7.3 (HIGH), this vulnerability poses a risk of unauthorized authentication, data interception (C:L, I:L), and denial-of-service (A:L) due to its network-based attack vector and low attack complexity. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB: None), and it is not listed in CISA's KEV catalog, though it has received some community discussion and media coverage.