CVE-2026-25711: chargemap.com · CWE-613
Affects chargemap.comSource CVE Database V5
Not known to be exploited · CVSS 7.3 High.
Data as of 30 Oct 2026, 11:52 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 26 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Chargemapchargemap.com | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2026-25711, Chargemap and affected organizations should implement the following specific measures: 1) Redesign session management to ensure session identifiers are unique, unpredictable, and bound to a single active connection, preventing multiple simultaneous connections with the same ID. 2) Implement strict session expiration and invalidation policies to prevent reuse of stale session identifiers. 3) Introduce authentication and authorization checks on WebSocket connections to verify the legitimacy of connecting endpoints before associating them with session IDs. 4) Employ rate limiting and connection throttling on the backend to mitigate denial-of-service attempts by limiting the number of session requests from a single source or within a time window. 5) Monitor WebSocket connection patterns and session anomalies to detect potential hijacking or shadowing attempts. 6) If possible, deploy Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) tuned to detect suspicious WebSocket traffic patterns. 7) Coordinate with Chargemap for official patches or updates addressing this vulnerability and apply them promptly once available. 8) Educate operational staff on the risks and signs of session hijacking to enable rapid incident response. These targeted actions go beyond generic advice by focusing on the specific session management flaws and attack vectors described.
Description
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.