CVE-2026-26305 is a high severity flaw (CVSS 7.5) in the Mobility46 charging backend. Its WebSocket API puts no limit on authentication requests, so an attacker can brute force access or flood it to disrupt charger telemetry. CISA says the vendor did not respond, so no fix is listed. Contact Mobility46.
What's affected
The CISA advisory ICSA-26-057-08 and the NVD record name mobility46.se as the affected product. It is a hosted service, so there is no version to patch.
CISA's remediation entry says Mobility46 did not respond to its request for coordination, and refers readers to the company's contact page. We found no published fix or workaround.
How to check if you're exposed
If you run chargers that report to Mobility46, check what you can see on your side: failed or repeated authentication attempts, chargers that drop off the backend, and telemetry gaps that do not match a real fault.
Ask the provider whether they log authentication attempts per source address and charger identifier, and whether they throttle them.
If your chargers are on your own network, review firewall rules so that only the chargers that need to reach the backend do.
What to do now
- Contact Mobility46 through its published contact page and ask for a fix timeline. Keep the reply.
- Ask whether authentication attempts are now limited per source and per identifier, and how lockouts are handled.
- Monitor charger availability and alert on sudden groups of disconnects.
- Use strong, unique credentials for each charger if the platform supports credentials, so brute forcing is not practical.
- Have a manual fallback for charger monitoring in case telemetry is disrupted.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. Without a rate limit, an attacker can try many credentials quickly, or send so many authentication requests that real chargers get delayed or mis-routed. The record says this can suppress or mis-route legitimate charger telemetry, as well as allow brute force access.
The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, scores the impact as availability only, which matches a denial of service. The record is not on the CISA Known Exploited Vulnerabilities list.
Rate limiting is old and well understood. It is also easy to forget on a machine to machine API where no human ever types a wrong password.
Quick check
Is there a fix for CVE-2026-26305?
No fix is listed. CISA says the vendor did not respond to its coordination request.
Why does the lack of a rate limit matter on an API?
Because it allows unlimited guessing and request floods, which can lock out real chargers or give an attacker access.
Sources
Last reviewed: 19 October 2026.
