CVE-2026-26305

CVE-2026-26305 describes a critical vulnerability in the WebSocket API of Mobility46 products, specifically mobility46.se, where a lack of rate limiting on authentication requests allows for denial-of-service or brute-force attacks. With a CVSS score of 9.8 (CRITICAL), this network-exploitable vulnerability requires no user interaction or privileges, posing a high risk of complete compromise to confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential future interest.