CVE-2026-26305 is a vulnerability identified in the WebSocket API of the Mobility46 platform (mobility46.se), which is used for managing charger telemetry. The core issue is the absence of restrictions on the number of authentication requests that can be made via the WebSocket interface. This lack of rate limiting allows attackers to flood the system with authentication attempts, which can lead to denial-of-service (DoS) conditions by suppressing or mis-routing legitimate telemetry data from chargers. Additionally, the vulnerability enables brute-force attacks to guess authentication credentials, potentially granting unauthorized access to the system. The vulnerability affects all versions of the product and can be exploited remotely without any prior authentication or user interaction, increasing its risk profile. The CVSS v3.1 base score is 7.5, reflecting high severity primarily due to the impact on availability and ease of exploitation. While no public exploits have been reported yet, the vulnerability's characteristics make it a credible threat to organizations relying on Mobility46's infrastructure for critical telemetry and charging operations. The CWE-307 classification highlights the failure to implement proper authentication rate limiting controls, a common security oversight that can have serious operational consequences.

The primary impact of CVE-2026-26305 is on the availability of services provided by the Mobility46 platform. By enabling denial-of-service attacks through unrestricted authentication requests, attackers can disrupt the flow of charger telemetry data, which may lead to operational outages or degraded service quality. This disruption can affect electric vehicle charging infrastructure, potentially causing downtime or incorrect telemetry reporting. Additionally, the possibility of brute-force attacks to gain unauthorized access threatens the integrity of the system's authentication mechanisms, potentially allowing attackers to manipulate or control charger telemetry data or configurations. For organizations worldwide, especially those managing large-scale EV charging networks or relying on Mobility46's platform for telemetry, this vulnerability could result in operational interruptions, financial losses, and reputational damage. The ease of remote exploitation without authentication or user interaction further elevates the risk, making it a critical concern for infrastructure resilience.

To mitigate CVE-2026-26305 effectively, organizations should implement strict rate limiting on all authentication requests at the WebSocket API level to prevent abuse through excessive attempts. Deploying Web Application Firewalls (WAFs) or API gateways capable of detecting and throttling abnormal traffic patterns can provide an additional layer of defense. Monitoring authentication logs and telemetry data for unusual spikes or repeated failed attempts is crucial for early detection of attack attempts. Organizations should also enforce strong authentication policies, such as multi-factor authentication (MFA), to reduce the risk of successful brute-force attacks. Network segmentation and limiting exposure of the WebSocket API to trusted networks can reduce the attack surface. Since no official patches are currently available, maintaining close communication with Mobility46 for updates and applying vendor patches promptly once released is essential. Finally, conducting regular security assessments and penetration testing focused on authentication mechanisms can help identify and remediate similar issues proactively.