Unauthorized Access Vulnerability in OCPP WebSocket Endpoint by Vendor

CVE-2026-26288

What is CVE-2026-26288?

The vulnerability in the OCPP WebSocket endpoints arises from a lack of proper authentication mechanisms. This flaw allows an attacker to perform unauthorized station impersonation by connecting to the WebSocket endpoint using a known charging station identifier. Once connected, the attacker can issue or receive OCPP commands as if they are a legitimate charger. The absence of authentication paves the way for potential privilege escalation, enabling unauthorized control over charging infrastructure and the possibility of data corruption within the charging network reported to the backend.

References