CVE Intelligence
Analysis AI-assisted

CVE-2026-26305: Mobility46 Mobility46.se Improper Restriction of Excessive Authentication Attempts

CVE-2026-26305 affects Mobility46 Mobility46.se and concerns the WebSocket API lacking limits on authentication requests, classified as CWE-307. The record reports a CVSS 3.1 base score of 9.8 from NVD and a CVSS 4.0 score of 8.7 from the CNA, and says the absence of rate limiting could enable denial-of-service or brute-force access. No confirmed exploitation appears in the sources consulted, and no fixed version is listed.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-26305 is a weakness in the WebSocket Application Programming Interface of Mobility46 Mobility46.se. The API does not restrict the number of authentication requests, which is classified as CWE-307, Improper Restriction of Excessive Authentication Attempts. The source describes this as an absence of rate limiting.

Impact

  • The record states that an attacker could suppress or mis-route legitimate charger telemetry, producing a denial-of-service condition.
  • The record states that an attacker could carry out brute-force attacks to gain unauthorized access.
  • NVD scores the issue at CVSS 3.1 9.8 (critical) with a vector indicating network access, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • The CNA score is CVSS 4.0 8.7, and a CVSS 3.1 score of 7.5 is also attributed to the CNA.

Affected products and versions

  • Product: Mobility46 Mobility46.se.
  • The sources state the versions are not specified and list "All versions" as the affected scope.
  • No fixed version is listed in the record.

Exploitation status

  • The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted. The SSVC exploitation value is recorded as none.
  • The FIRST EPSS probability is 0.00953 with a percentile of 0.60992, which are estimates and not evidence of exploitation.

Remediation and mitigation

  • Check the vendor contact page and the CISA advisory for an official fix or guidance from the vendor.
  • Until a fix is confirmed, limit exposure of the WebSocket interface to trusted networks and restrict access to charger management functions.
  • Apply external controls such as network segmentation and access allow-lists, since the record does not describe a vendor-side rate limit.

Detection guidance

  • Monitor authentication activity on the WebSocket interface for unusually high volumes of attempts from single sources.
  • Watch for unexpected gaps or changes in charger telemetry that could indicate disruption.

Limitations of the available information

  • The record does not identify specific affected or fixed versions.
  • The record does not confirm whether the vendor has issued a patch.
  • Scores differ between CVSS 3.1 and 4.0 sources; the record does not explain the difference beyond listing the providers.

Frequently asked questions

What is the weakness in CVE-2026-26305?

The WebSocket API does not restrict the number of authentication requests, which is classified as CWE-307.

Is this CVE known to be actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list a fixed version. The vendor contact page and CISA advisory should be checked for guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.