WebSocket Security Flaw in Charging Infrastructure from Mobiliti
CVE-2026-26051

9.3CRITICAL

Key Information:

Vendor

Mobiliti

Status
E-mobi.hu
Vendor
CVE Published:
6 March 2026

What is CVE-2026-26051?

The vulnerability affects Mobiliti's charging infrastructure where WebSocket endpoints do not implement adequate authentication. This flaw allows unauthorized individuals to impersonate legitimate charging stations and manipulate data flowing between the charging stations and the backend systems. By exploiting this vulnerability, an attacker can issue or receive Open Charge Point Protocol (OCPP) commands without needing authentication. This lack of security measures opens the door to possible unauthorized control over charging sessions, leading to a risk of privilege escalation and corruption of critical network data.

Affected Version(s)

e-mobi.hu All versions

References

https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszol...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
.