The WebSocket backend at Chargemap associates charging session identifiers to stations, but it accepts multiple connections sharing the same identifier. Because the identifiers are predictable, an attacker can hijack or shadow an active session, forcing the backend to send commands to a different station. This flaw enables an unauthorized user to impersonate another station, gaining control over its operations, or to flood the backend with session requests, causing a denial of service. The weakness is a classic session management flaw, identified as CWE‑613.

The vulnerability affects the Chargemap charging station platform accessed via chargemap.com. No specific product version or version range is listed, so all deployments using the WebSocket backend presented in the current application are potentially vulnerable.

The CVSS score is 6.9, indicating a medium severity risk. The EPSS shows a probability of fewer than 1 %, suggesting a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require reachability of the WebSocket endpoint and the ability to supply a chosen session identifier. Because the session IDs are predictable and the backend accepts concurrent connections with the same ID, an attacker can hijack an existing session or shadow the legitimate station without needing privileged credentials, making this flaw readily exploitable for non‑destructive attacks such as unauthorized control or DoS.