The vulnerability arises from the WebSocket backend using charging station identifiers as session identifiers but permitting multiple connections with the same identifier. This design flaw leads to predictable session identifiers, enabling session hijacking or shadowing attacks. An attacker can displace a legitimate charging station's session, intercept commands, or cause denial-of-service by flooding the backend with session requests. The issue is categorized under CWE-613 (Insufficient Session Expiration). The vulnerability affects all versions of mobility46.se and was published on 2026-02-27. No known exploits are reported in the wild, and no patch or vendor advisory detailing remediation is currently available.

An attacker can hijack or shadow sessions by connecting with the same session identifier, potentially authenticating as other users or displacing legitimate charging stations. This can lead to unauthorized command execution or denial-of-service conditions by overwhelming the backend with session requests. The confidentiality, integrity, and availability of the affected system are all impacted to a limited degree, consistent with the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the WebSocket backend, implementing additional session validation mechanisms, or monitoring for unusual session connection patterns to reduce risk. Avoid relying solely on session identifiers that can be reused or predicted.