CVE-2026-27764: WebSocket Backend Auth Bypass Vulnerability

CVE-2026-27764 Overview

CVE-2026-27764 is a session management vulnerability affecting WebSocket-based electric vehicle (EV) charging station backend systems. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station.

This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Critical Impact

Attackers can hijack legitimate charging station sessions, intercept backend commands, impersonate authorized stations, or cause denial-of-service conditions affecting critical EV charging infrastructure.

Affected Products

• EV Charging Station WebSocket Backend Systems
• Mobiliti E-Mobility Platform Components
• Industrial Control Systems utilizing vulnerable session management

Discovery Timeline

• 2026-03-06 - CVE-2026-27764 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-27764

Vulnerability Analysis

This vulnerability is classified under CWE-613 (Insufficient Session Expiration), indicating fundamental weaknesses in how the WebSocket backend manages session lifecycles. The core issue stems from the system's reliance on charging station identifiers as the sole mechanism for session association without implementing proper session uniqueness validation or connection displacement protection.

When multiple WebSocket connections attempt to use the same charging station identifier, the backend fails to properly validate and reject duplicate session requests. Instead, the system accepts the new connection and routes subsequent communications to the most recently connected endpoint. This behavior creates a race condition where attackers can monitor for legitimate station connections and rapidly establish competing sessions to intercept backend commands.

The network-accessible attack surface combined with the lack of authentication complexity requirements means that remote attackers can exploit this vulnerability without prior authentication or user interaction. The impact extends to confidentiality, integrity, and availability of the affected charging infrastructure.

Root Cause

The root cause of this vulnerability lies in insufficient session expiration and inadequate session binding mechanisms. The backend system uses predictable charging station identifiers without implementing cryptographically secure session tokens or mutual authentication between the backend and charging stations. Additionally, the system lacks session locking mechanisms that would prevent connection displacement when a legitimate session is already active.

The absence of proper session validation allows attackers to enumerate valid charging station identifiers and establish unauthorized WebSocket connections that shadow or completely hijack legitimate station communications.

Attack Vector

The attack vector for CVE-2026-27764 is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying target charging station identifiers through reconnaissance or enumeration
2. Establishing a WebSocket connection to the backend using the victim station's identifier
3. Displacing the legitimate charging station connection
4. Intercepting or manipulating backend commands intended for the legitimate station
5. Alternatively, overwhelming the backend with valid session requests to cause denial-of-service

The attack can be executed remotely over the network, targeting the WebSocket endpoint that manages charging station communications. Since the session identifiers are predictable, attackers can systematically target multiple stations across the infrastructure.

Detection Methods for CVE-2026-27764

Indicators of Compromise

• Multiple simultaneous WebSocket connections from different IP addresses using the same charging station identifier
• Rapid session establishment and termination patterns indicating connection displacement attacks
• Unusual geographic distribution of connection sources for individual station identifiers
• Backend command acknowledgments from unexpected network locations

Detection Strategies

• Implement logging and alerting for duplicate session identifier connections within short time windows
• Monitor for sudden disconnection events followed by immediate reconnections from different source IPs
• Analyze WebSocket connection metadata for anomalous patterns in connection establishment timing
• Deploy network intrusion detection rules to identify session hijacking attempt signatures

Monitoring Recommendations

• Enable detailed WebSocket connection logging including source IP, timestamp, and station identifier
• Configure alerts for session displacement events where active connections are terminated by competing connections
• Monitor for elevated rates of WebSocket connection attempts that may indicate denial-of-service activity
• Implement geographic baseline monitoring to detect connections from unexpected regions

How to Mitigate CVE-2026-27764

Immediate Actions Required

• Review current WebSocket session management configurations and identify vulnerable deployments
• Implement connection rate limiting to reduce denial-of-service attack effectiveness
• Enable enhanced logging for all charging station WebSocket connections
• Contact Mobiliti customer support for vendor-specific guidance on available patches or mitigations

Patch Information

Organizations should consult the CISA ICS Advisory #ICSA-26-062-06 for official guidance and remediation steps. Additional technical details are available in the GitHub CSAF Document. For vendor-specific support, contact the Mobiliti Customer Support Page to obtain updated firmware or software that addresses this vulnerability.

Workarounds

• Implement network segmentation to restrict WebSocket endpoint access to trusted network ranges only
• Deploy Web Application Firewall (WAF) rules to detect and block suspicious session hijacking patterns
• Configure session binding to additional authentication factors beyond station identifiers
• Implement mutual TLS authentication between charging stations and the backend

# Example network segmentation configuration for charging station backend
# Restrict WebSocket access to known charging station IP ranges

# iptables example - allow only trusted station networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Enable connection rate limiting per source IP
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 5 -j REJECT