Session Hijacking Vulnerability in Charging Station Management Software
CVE-2026-25711

6.9MEDIUM

Key Information:

Vendor

Chargemap

Status
Chargemap.com
Vendor
CVE Published:
26 February 2026

What is CVE-2026-25711?

This vulnerability arises from the charging station management software's WebSocket backend, which relies on session identifiers that can be easily predicted. The software permits multiple endpoints to connect using the same session identifier, leading to risks of session hijacking. Malicious actors can exploit this flaw, allowing them to impersonate legitimate users or overwhelm the backend system, potentially causing a denial-of-service condition. This situation not only exposes users to unauthorized access but also disrupts service availability. It is vital for users to implement necessary security measures to protect against these exploits.

Affected Version(s)

chargemap.com All versions

References

https://chargemap.com/en-us/support
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA
.