CVE-2026-50176 describes a vulnerability in the EVoke CSMS product where the WebSocket Application Programming Interface does not enforce limits on authentication request frequency. This absence of rate limiting (CWE-307) could allow attackers to perform denial-of-service attacks by overwhelming the service or attempt brute-force attacks to gain unauthorized access. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5 (Network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but high availability impact). No official remediation or patch information is currently available, and no affected versions are specified.

The vulnerability can lead to denial-of-service conditions by allowing attackers to flood the authentication mechanism with requests, potentially disrupting service availability. Additionally, the lack of rate limiting may facilitate brute-force attempts to guess authentication credentials, risking unauthorized access. There is no reported confidentiality or integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or monitoring controls on the WebSocket authentication endpoint to mitigate potential abuse. Avoid relying solely on the vulnerable WebSocket API for authentication without additional protections.