CVE-2026-26051: WebSocket Auth Bypass Vulnerability

CVE-2026-26051 Overview

CVE-2026-26051 is a critical authentication bypass vulnerability affecting WebSocket endpoints in electric vehicle (EV) charging infrastructure. The vulnerability stems from missing authentication mechanisms on OCPP (Open Charge Point Protocol) WebSocket endpoints, which allows unauthenticated attackers to impersonate legitimate charging stations and manipulate backend communications.

An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact
Unauthenticated remote attackers can impersonate charging stations over the network, potentially compromising entire EV charging networks and manipulating critical infrastructure data.

Affected Products

OCPP-based EV Charging Management Systems
Electric Vehicle Charging Station Backend Services
WebSocket-enabled Charging Infrastructure Components

Discovery Timeline

March 6, 2026 - CVE-2026-26051 published to NVD
March 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26051

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The OCPP WebSocket endpoints fail to implement proper authentication mechanisms, creating a significant security gap in EV charging infrastructure. The vulnerability is remotely exploitable with low attack complexity and requires no user interaction or prior privileges, making it highly accessible to potential attackers.

The impact is substantial across confidentiality and integrity dimensions—attackers can both read sensitive charging station data and inject malicious commands into the backend system. While availability impact is lower, the potential for data corruption and unauthorized infrastructure control represents a severe risk to critical infrastructure operations.

Root Cause

The root cause of CVE-2026-26051 is the complete absence of authentication mechanisms on WebSocket endpoints used for OCPP communications. The system accepts connections from any client that presents a valid charging station identifier without verifying the identity of the connecting entity. This design flaw violates fundamental security principles for critical infrastructure systems, where strong mutual authentication should be mandatory.

Attack Vector

The attack vector operates over the network, allowing remote exploitation without physical access to the charging infrastructure. An attacker can exploit this vulnerability through the following sequence:

Discover or enumerate valid charging station identifiers through reconnaissance
Establish a WebSocket connection to the OCPP endpoint using a target station's identifier
Send OCPP commands as the impersonated charging station
Receive backend responses and commands intended for the legitimate station
Manipulate charging session data, billing information, or infrastructure status reports

The attack requires no authentication credentials, special privileges, or user interaction, making it trivially exploitable once an attacker identifies the WebSocket endpoint and valid station identifiers. Attackers could potentially disrupt charging operations, manipulate energy consumption data, or use the compromised position to pivot deeper into the charging network's infrastructure.

Detection Methods for CVE-2026-26051

Indicators of Compromise

Multiple WebSocket connections originating from the same charging station identifier but different source IP addresses
Unusual geographic patterns in connection origins that don't match physical station locations
Anomalous OCPP command sequences or timing patterns that deviate from normal charger behavior
Conflicting status reports or charging session data for the same station identifier

Detection Strategies

Implement WebSocket connection logging with correlation analysis to detect duplicate station identifier usage
Deploy network intrusion detection rules to identify OCPP traffic anomalies and unauthorized connection attempts
Monitor for rapid connection attempts to OCPP endpoints from unexpected network ranges
Establish baseline behavioral profiles for charging stations and alert on deviations

Monitoring Recommendations

Enable detailed audit logging for all OCPP WebSocket connections including source IP, timestamp, and station identifier
Implement real-time alerting for multiple concurrent sessions using the same station identifier
Monitor backend data integrity for inconsistencies that may indicate impersonation attacks
Review network traffic patterns to OCPP endpoints for reconnaissance or enumeration activity

How to Mitigate CVE-2026-26051

Immediate Actions Required

Implement strong mutual authentication (TLS client certificates) for all OCPP WebSocket connections
Deploy network segmentation to restrict access to OCPP endpoints from untrusted networks
Enable IP allowlisting for known charging station IP addresses where feasible
Conduct an audit of existing station identifiers to ensure uniqueness and prevent enumeration

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-062-06 for official guidance and remediation recommendations. Additionally, affected organizations can review the GitHub CSAF JSON File for detailed vulnerability information in machine-readable format. Users of Mobiliti systems should contact Mobiliti Customer Support for vendor-specific patches and updates.

Workarounds

Place OCPP WebSocket endpoints behind a VPN or private network to limit exposure
Implement application-layer authentication checks at the backend to validate station identity
Deploy a Web Application Firewall (WAF) with custom rules to detect and block suspicious OCPP traffic
Use station-specific authentication tokens until proper certificate-based authentication can be implemented

bash

# Example: Restrict OCPP WebSocket access to known station IP ranges using iptables
iptables -A INPUT -p tcp --dport 9000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP