CVE-2026-25114

CVE-2026-25114 describes a critical vulnerability in the CloudCharge cloudcharge.se WebSocket API, stemming from a lack of rate limiting on authentication requests. This flaw allows unauthenticated attackers to perform denial-of-service attacks by disrupting charger telemetry or brute-force attacks to gain unauthorized access. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential future exploitation.