Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-20748: Charging Station Identifiers Not Secure, Allows Session Hijacking

CVE-2026-20748 · published 8 months ago

Summary

The software allows multiple users to share the same session identifier, making it possible for unauthorized users to impersonate legitimate users or flood the system with fake requests, disrupting normal operation. This could lead to unauthorized access or denial of service. Users should update the system to ensure unique and secure session identifiers are used.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
everon	api.everon.io	All versions `cpe:2.3:a:everon:api.everon.io::::::::`

Original advisory text

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-06... Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-08 US Government Resource

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-613Insufficient Session Expiration

Timeline

Published6 Mar 2026

Updated1 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-20748 · NVD

Track software like this

Free during beta