CVE-2026-97212

High7.3 Published on Oct 2, 2026

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

CVSS score7.3 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness type (CWE)CWE-613

Vulnerabilities

Four Monta Platform Flaws Put Charging-Station Access and Availability at Risk

CISA warns four Monta monta.app flaws (CVSS 9.4) allow station impersonation, credential exposure, DoS and unauthorized charging control.

Oct 2, 202611:32 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Four Monta Platform Flaws Put Charging-Station Access and Availability at Risk