CVE-2026-95102: CWE-306 in Monta monta.app

The vulnerability identified as CVE-2026-95102 in Monta's monta.app involves WebSocket endpoints that do not enforce authentication mechanisms. This weakness enables attackers to impersonate legitimate charging stations, thereby accessing sensitive information or executing unauthorized operations. The flaw corresponds to CWE-306, indicating missing or insufficient authentication controls. The CVSS v3.1 score of 9.4 reflects the critical nature of this issue, with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and low impact on availability.

Exploitation of this vulnerability can lead to unauthorized access to sensitive data and unauthorized actions within the monta.app system. Attackers can impersonate charging stations, potentially escalating privileges and compromising the overall security of the system. The critical CVSS score indicates a severe impact on confidentiality and integrity, with some impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Monta's advisories for updates. Until a fix is available, restricting access to WebSocket endpoints and implementing network-level controls may help reduce exposure.