The vulnerability CVE-2026-44383 in Hydro-Québec's Le Circuit Electrique charging station backend permits multiple concurrent connections using the same charging station identifier. This flaw relates to insufficient session expiration controls (CWE-613), which can be exploited by attackers to deploy numerous malicious OCPP clients, thereby overwhelming the backend infrastructure. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The primary impact is a high availability risk to the charging station backend due to the potential for denial-of-service conditions caused by multiple malicious clients connecting with the same station ID. Confidentiality and integrity are not affected according to the CVSS vector. This could disrupt charging services relying on this backend.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitoring for unusual connection patterns and limiting concurrent connections per charging station ID, if possible, may help mitigate risk. No official remediation or temporary fixes are currently documented.