Authentication Flaw in WebSocket Endpoints of Charging Infrastructure by CloudCharge
CVE-2026-20781

9.3CRITICAL

Key Information:

Vendor

Cloudcharge

Status
Cloudcharge.se
Vendor
CVE Published:
26 February 2026

What is CVE-2026-20781?

The identified vulnerability in CloudCharge's charging infrastructure is due to improper authentication mechanisms in WebSocket endpoints. This flaw allows unauthorized actors to impersonate legitimate charging stations by connecting to the OCPP WebSocket endpoint with a known charging station identifier. Without any authentication requirements, these attackers can issue commands and manipulate data interchangeably as if they were legitimate operators. This situation poses risks of unauthorized control over charging infrastructure and potential data corruption within the backend reporting system.

Affected Version(s)

cloudcharge.se All versions

References

https://cloudcharge.tech/support/contact/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
.