The monta.app WebSocket backend uses charging station identifiers as session identifiers but permits multiple endpoints to connect using the same session ID. This results in predictable session identifiers (CWE-613), enabling unauthorized authentication or denial-of-service attacks by overwhelming the backend with valid session requests. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

An attacker can exploit predictable session identifiers to authenticate as other users without authorization or cause a denial-of-service condition by flooding the backend with multiple valid session requests. This compromises user session integrity and availability of the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual session activity and consider restricting access to the WebSocket backend where possible.