CVE-2026-24912

CVE-2026-24912 describes a vulnerability in a WebSocket backend that uses predictable charging station identifiers for session management. This allows multiple connections with the same ID, leading to session hijacking or shadowing where legitimate stations are displaced and backend commands are misdirected. With a CVSS score of 7.3 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, potentially enabling unauthorized authentication, data exposure, or denial-of-service conditions. There is currently no public exploit code available, and it is not known to be actively exploited, though it has received some community discussion and media coverage.