CVE-2026-27649

CVE-2026-27649 describes a session hijacking and shadowing vulnerability in WebSocket backends that use charging station identifiers for session management, potentially impacting systems like the CTEK Chargeportal. Rated 7.3 HIGH on the CVSS scale, this flaw is easily exploitable over the network without authentication or user interaction due to predictable session identifiers. Exploitation could lead to unauthorized user authentication, displacement of legitimate charging stations, and denial-of-service, resulting in low impacts to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's KEV catalog.