The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...

zetlyn/cve-ghsa vulnerability ghsa GHSA-jwgf-7prh-7v76 cve CVE-2026-97212 known 2026-10-03

https://github.com/advisories/GHSA-jwgf-7prh-7v76

Properties

cvss7.3
receipt
Source
GitHub advisories
Its words
7.3
Read by
field:cvss.score
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-613
receipt
Source
GitHub advisories
Its words
CWE-613
Read by
field:cwes[].cwe_id
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severitymedium
receipt
Source
GitHub advisories
Its words
medium
Read by
field:severity
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows... The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.