CVE-2026-26288 - Vulnerability Analysis
CriticalCVSS: 9.4Last Updated: March 6, 2026
OCPP WebSocket - Broken Access Control
Published: March 6, 2026Updated: March 6, 2026Remote Exploitable
Overview
OCPP WebSocket endpoints contain a broken access control vulnerability caused by lack of authentication, letting unauthenticated attackers impersonate stations and manipulate backend data, exploit requires no authentication.
Severity & Score
Severity: Critical
CVSS Score: 9.4
Impact
Unauthenticated attackers can impersonate charging stations, escalate privileges, and manipulate charging infrastructure and backend data.
Mitigation
Implement proper authentication mechanisms on WebSocket endpoints or update to a version with authentication.
References
Related Resources
Details
- CVE ID
- CVE-2026-26288
- Severity
- Critical
- CVSS Score
- 9.4
- Type
- broken_access_control
- Status
- new
CWE
- CWE-306
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L