CVE-2026-26051: WebSocket Auth Bypass Vulnerability

CVE-2026-26051 Overview

CVE-2026-26051 is a critical authentication bypass vulnerability affecting WebSocket endpoints in electric vehicle (EV) charging infrastructure. The vulnerability stems from missing authentication mechanisms on OCPP (Open Charge Point Protocol) WebSocket endpoints, which allows unauthenticated attackers to impersonate legitimate charging stations and manipulate backend communications.

An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact

Unauthenticated remote attackers can impersonate charging stations over the network, potentially compromising entire EV charging networks and manipulating critical infrastructure data.

Affected Products

• OCPP-based EV Charging Management Systems
• Electric Vehicle Charging Station Backend Services
• WebSocket-enabled Charging Infrastructure Components

Discovery Timeline

• March 6, 2026 - CVE-2026-26051 published to NVD
• March 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26051

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The OCPP WebSocket endpoints fail to implement proper authentication mechanisms, creating a significant security gap in EV charging infrastructure. The vulnerability is remotely exploitable with low attack complexity and requires no user interaction or prior privileges, making it highly accessible to potential attackers.

The impact is substantial across confidentiality and integrity dimensions—attackers can both read sensitive charging station data and inject malicious commands into the backend system. While availability impact is lower, the potential for data corruption and unauthorized infrastructure control represents a severe risk to critical infrastructure operations.

Root Cause

The root cause of CVE-2026-26051 is the complete absence of authentication mechanisms on WebSocket endpoints used for OCPP communications. The system accepts connections from any client that presents a valid charging station identifier without verifying the identity of the connecting entity. This design flaw violates fundamental security principles for critical infrastructure systems, where strong mutual authentication should be mandatory.

Attack Vector

The attack vector operates over the network, allowing remote exploitation without physical access to the charging infrastructure. An attacker can exploit this vulnerability through the following sequence:

1. Discover or enumerate valid charging station identifiers through reconnaissance
2. Establish a WebSocket connection to the OCPP endpoint using a target station's identifier
3. Send OCPP commands as the impersonated charging station
4. Receive backend responses and commands intended for the legitimate station
5. Manipulate charging session data, billing information, or infrastructure status reports

The attack requires no authentication credentials, special privileges, or user interaction, making it trivially exploitable once an attacker identifies the WebSocket endpoint and valid station identifiers. Attackers could potentially disrupt charging operations, manipulate energy consumption data, or use the compromised position to pivot deeper into the charging network's infrastructure.

Detection Methods for CVE-2026-26051

Indicators of Compromise

• Multiple WebSocket connections originating from the same charging station identifier but different source IP addresses
• Unusual geographic patterns in connection origins that don't match physical station locations
• Anomalous OCPP command sequences or timing patterns that deviate from normal charger behavior
• Conflicting status reports or charging session data for the same station identifier

Detection Strategies

• Implement WebSocket connection logging with correlation analysis to detect duplicate station identifier usage
• Deploy network intrusion detection rules to identify OCPP traffic anomalies and unauthorized connection attempts
• Monitor for rapid connection attempts to OCPP endpoints from unexpected network ranges
• Establish baseline behavioral profiles for charging stations and alert on deviations

Monitoring Recommendations

• Enable detailed audit logging for all OCPP WebSocket connections including source IP, timestamp, and station identifier
• Implement real-time alerting for multiple concurrent sessions using the same station identifier
• Monitor backend data integrity for inconsistencies that may indicate impersonation attacks
• Review network traffic patterns to OCPP endpoints for reconnaissance or enumeration activity

How to Mitigate CVE-2026-26051

Immediate Actions Required

• Implement strong mutual authentication (TLS client certificates) for all OCPP WebSocket connections
• Deploy network segmentation to restrict access to OCPP endpoints from untrusted networks
• Enable IP allowlisting for known charging station IP addresses where feasible
• Conduct an audit of existing station identifiers to ensure uniqueness and prevent enumeration

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-062-06 for official guidance and remediation recommendations. Additionally, affected organizations can review the GitHub CSAF JSON File for detailed vulnerability information in machine-readable format. Users of Mobiliti systems should contact Mobiliti Customer Support for vendor-specific patches and updates.

Workarounds

• Place OCPP WebSocket endpoints behind a VPN or private network to limit exposure
• Implement application-layer authentication checks at the backend to validate station identity
• Deploy a Web Application Firewall (WAF) with custom rules to detect and block suspicious OCPP traffic
• Use station-specific authentication tokens until proper certificate-based authentication can be implemented

# Example: Restrict OCPP WebSocket access to known station IP ranges using iptables
iptables -A INPUT -p tcp --dport 9000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP