Session Hijacking Vulnerability in Charging Station Backend Software by CloudCharge

CVE-2026-27652

What is CVE-2026-27652?

The charging station backend software by CloudCharge allows multiple endpoints to connect using the same session identifier due to flawed handling of charging station identifiers. This implementation leads to predictable session identifiers, making it possible for malicious actors to hijack sessions. When a new endpoint connects, it can displace the legitimate connection, gaining access to backend commands intended for the authenticated charging station. This situation not only opens doors for unauthorized user authentication but also holds the risk of denial-of-service attacks as the backend may be overwhelmed by a flood of legitimate session requests from compromised connections.

References