The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

cve CVE-2026-97212 2 sources, 2 claims · Watch

NVD writes:
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests. the claim

What it is to other things

In words only, so not counted until a person confirms one:

affectsmonta/monta_app
NVD says “Monta · monta.app”
made_bymonta
NVD says “Monta”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
GitHub advisories7.3
receipt
Source
GitHub advisories
Its words
7.3
Read by
field:cvss.score
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Cvss
cvss
NVD7.3
receipt
Source
NVD
Its words
7.3
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 00:06 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "monta.app",
            "vendor": "Monta",
            "versions": [
              {
                "status": "affected",
                "version": "All versions"
              }
            ]
          }
        ],
        "source": "ics-cert@hq.dhs.gov"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests."
      }
    ],
    "id": "CVE-2026-97212",
    "lastModified": "2026-10-02T22:16:56.760",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-10-02T22:16:56.760",
    "references": [
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"
      },
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02"
      }
    ],
    "sourceIdentifier": "ics-cert@hq.dhs.gov",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "ics-cert@hq.dhs.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Cwe
cwe
GitHub advisoriesCWE-613
receipt
Source
GitHub advisories
Its words
CWE-613
Read by
field:cwes[].cwe_id
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Product
product
NVDmonta.app
receipt
Source
NVD
Its words
monta.app
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 00:06 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "monta.app",
            "vendor": "Monta",
            "versions": [
              {
                "status": "affected",
                "version": "All versions"
              }
            ]
          }
        ],
        "source": "ics-cert@hq.dhs.gov"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests."
      }
    ],
    "id": "CVE-2026-97212",
    "lastModified": "2026-10-02T22:16:56.760",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-10-02T22:16:56.760",
    "references": [
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"
      },
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02"
      }
    ],
    "sourceIdentifier": "ics-cert@hq.dhs.gov",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "ics-cert@hq.dhs.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Severity
severity
GitHub advisoriesmedium
receipt
Source
GitHub advisories
Its words
medium
Read by
field:severity
Said since
2026-10-03 06:04 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-97212",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 6.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-613",
      "name": "Insufficient Session Expiration"
    }
  ],
  "description": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.",
  "ghsa_id": "GHSA-jwgf-7prh-7v76",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jwgf-7prh-7v76",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jwgf-7prh-7v76"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-97212"
    }
  ],
  "nvd_published_at": "2026-10-02T22:16:56Z",
  "published_at": "2026-10-03T00:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-97212",
    "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json",
    "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02",
    "https://github.com/advisories/GHSA-jwgf-7prh-7v76"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T00:31:16Z",
  "url": "https://api.github.com/advisories/GHSA-jwgf-7prh-7v76",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Status
status
NVDReceived
receipt
Source
NVD
Its words
Received
Read by
field:cve.vulnStatus
Said since
2026-10-03 00:06 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "monta.app",
            "vendor": "Monta",
            "versions": [
              {
                "status": "affected",
                "version": "All versions"
              }
            ]
          }
        ],
        "source": "ics-cert@hq.dhs.gov"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests."
      }
    ],
    "id": "CVE-2026-97212",
    "lastModified": "2026-10-02T22:16:56.760",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-10-02T22:16:56.760",
    "references": [
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"
      },
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02"
      }
    ],
    "sourceIdentifier": "ics-cert@hq.dhs.gov",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "ics-cert@hq.dhs.gov",
        "type": "Primary"
      }
    ]
  }
}
—
Vendor
vendor
NVDMonta
receipt
Source
NVD
Its words
Monta
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 00:06 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "monta.app",
            "vendor": "Monta",
            "versions": [
              {
                "status": "affected",
                "version": "All versions"
              }
            ]
          }
        ],
        "source": "ics-cert@hq.dhs.gov"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests."
      }
    ],
    "id": "CVE-2026-97212",
    "lastModified": "2026-10-02T22:16:56.760",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "ics-cert@hq.dhs.gov",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-10-02T22:16:56.760",
    "references": [
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"
      },
      {
        "source": "ics-cert@hq.dhs.gov",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02"
      }
    ],
    "sourceIdentifier": "ics-cert@hq.dhs.gov",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "ics-cert@hq.dhs.gov",
        "type": "Primary"
      }
    ]
  }
}
—

vulnerability

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
zetlyn/cve-nvd · 2026-10-02
cvss 7.3 product monta.app status Received vendor Monta source
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...
zetlyn/cve-ghsa · 2026-10-03
cvss 7.3 cwe CWE-613 severity medium source