CVE-2026-20895

CVE-2026-20895 is a session hijacking and denial-of-service vulnerability affecting ev2go.io's WebSocket backend. The flaw stems from predictable session identifiers, allowing multiple endpoints to connect using the same ID, displacing legitimate charging stations. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low complexity, potentially leading to unauthorized authentication or a denial-of-service condition. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage.