CVE-2026-27028: Mobility46.se Auth Bypass Vulnerability

CVE-2026-27028 Overview

CVE-2026-27028 is a critical authentication bypass vulnerability affecting WebSocket endpoints in Mobility46's electric vehicle charging infrastructure platform. The vulnerability stems from missing authentication mechanisms on OCPP (Open Charge Point Protocol) WebSocket endpoints, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend systems.

An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact

Unauthenticated remote attackers can impersonate legitimate charging stations, issue unauthorized OCPP commands, and corrupt backend charging network data, potentially disrupting critical EV charging infrastructure.

Affected Products

• Mobility46 mobility46.se (all versions)

Discovery Timeline

• 2026-02-27 - CVE-2026-27028 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27028

Vulnerability Analysis

This vulnerability is classified as CWE-306: Missing Authentication for Critical Function. The core issue lies in the complete absence of authentication mechanisms on WebSocket endpoints that handle OCPP communications between charging stations and the backend management system.

OCPP is a standard protocol used for communication between EV charging stations and central management systems. In a properly secured implementation, charging stations must authenticate before being permitted to send or receive commands. However, the Mobility46 platform fails to enforce any authentication on these critical WebSocket endpoints, allowing any network-connected attacker to establish a connection simply by knowing or guessing a charging station identifier.

The attack surface is network-accessible without requiring any privileges or user interaction, making this vulnerability particularly dangerous in operational technology (OT) environments where charging infrastructure may be deployed across public networks.

Root Cause

The root cause is the complete absence of authentication controls on the OCPP WebSocket endpoint. The system accepts connections and processes OCPP commands based solely on the provided station identifier, without verifying that the connecting client is actually the legitimate charging station it claims to be. This represents a fundamental design flaw in the authentication architecture of the platform.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following approach:

1. The attacker identifies or discovers valid charging station identifiers (through enumeration, network reconnaissance, or physical observation of deployed chargers)
2. The attacker establishes a WebSocket connection to the OCPP endpoint using a known station identifier
3. Once connected, the attacker can send malicious OCPP commands impersonating the legitimate charging station
4. The attacker can also intercept or manipulate data intended for the actual charging station

This attack methodology allows for station impersonation, command injection, data manipulation, and potential denial of service against legitimate charging operations. The vulnerability is particularly concerning given its applicability to critical infrastructure systems.

Detection Methods for CVE-2026-27028

Indicators of Compromise

• Multiple WebSocket connections from different IP addresses using the same charging station identifier
• Anomalous OCPP command sequences or commands issued outside normal operational patterns
• Connections to OCPP endpoints from unexpected geographic locations or IP ranges
• Rapid connection/disconnection cycles or connection attempts with sequential station identifiers

Detection Strategies

• Implement network monitoring to detect WebSocket connections to OCPP endpoints from unauthorized IP addresses
• Deploy anomaly detection systems to identify unusual OCPP command patterns or frequencies
• Monitor authentication logs for failed or suspicious connection attempts to charging infrastructure
• Correlate network traffic analysis with expected charging station locations and operational schedules

Monitoring Recommendations

• Enable detailed logging on all OCPP WebSocket endpoints to capture connection metadata and command history
• Implement alerting for duplicate station identifier connections from different source IPs
• Deploy intrusion detection signatures specifically targeting OCPP protocol anomalies
• Establish baseline behavioral profiles for each charging station to detect deviations

How to Mitigate CVE-2026-27028

Immediate Actions Required

• Restrict network access to OCPP WebSocket endpoints using firewall rules or network segmentation
• Implement IP allowlisting to limit connections to known, legitimate charging station IP addresses
• Deploy a VPN or secure tunnel for all charging station-to-backend communications
• Review logs for any evidence of prior exploitation or unauthorized access attempts

Patch Information

At the time of publication, no vendor patch information is available. Organizations should monitor the CISA ICS Advisory and Mobility46 Contact Information for updates on security fixes. Additional technical details are available in the GitHub CSAF JSON Resource.

Workarounds

• Implement a reverse proxy or API gateway with authentication enforcement in front of the OCPP WebSocket endpoints
• Deploy network segmentation to isolate charging infrastructure from untrusted networks
• Use certificate-based mutual TLS authentication at the network layer as a compensating control
• Consider deploying an application-level firewall capable of inspecting and filtering OCPP traffic

Network segmentation and access control configuration should be implemented according to your organization's security architecture. Ensure that only authorized charging stations with verified network identities can reach the OCPP endpoints until a proper authentication mechanism is implemented by the vendor.