The vulnerability identified as CVE-2026-26305 affects all versions of Mobility46's mobility46.se product. It is caused by the WebSocket API not enforcing restrictions on the number of authentication requests, classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). This absence of rate limiting can be exploited to perform denial-of-service attacks that suppress or mis-route legitimate telemetry data from chargers or to conduct brute-force attacks aimed at unauthorized access. The CVSS v3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). No patches or fixes have been documented, and the product is not a cloud service, so remediation depends on vendor action.

The impact of this vulnerability is primarily denial of service, which can disrupt legitimate charger telemetry by suppressing or mis-routing data. Additionally, the lack of rate limiting may allow brute-force attacks to attempt unauthorized access. There is no reported confidentiality or integrity impact. The vulnerability could affect availability of the service, potentially impacting operational continuity of charging infrastructure relying on this product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider implementing external rate limiting or network-level controls to mitigate excessive authentication attempts if feasible. Avoid relying solely on the vulnerable WebSocket API for critical authentication without additional protective measures.