The EVoke CSMS WebSocket backend associates sessions with charging station identifiers but permits multiple endpoints to use the same session identifier. This results in predictable session identifiers (CWE-613), which may allow unauthorized users to impersonate others or enable denial-of-service attacks by flooding the backend with valid session requests. No patch or official remediation is currently documented.

An attacker could exploit predictable session identifiers to authenticate as other users, potentially gaining unauthorized access. Additionally, the vulnerability allows a malicious actor to cause denial-of-service conditions by overwhelming the backend with multiple valid session requests using the same session ID. The impact includes confidentiality, integrity, and availability losses, all rated as low to moderate but collectively significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the WebSocket backend, implementing additional authentication or session management controls, and monitoring for unusual connection patterns to mitigate potential abuse.