The WebSocket backend of EV Energy’s ev.energy platform uses charging station identifiers as session tokens, allowing multiple endpoints to connect using the same session ID. Because the identifiers are predictable, an attacker can hijack or shadow a legitimate charging station, receiving and potentially manipulating backend commands meant for that station. The flaw also permits flooding the backend with valid session requests, creating a denial‑of‑service condition.

The vulnerability affects all deployments of the ev.energy WebSocket backend; no specific version information is supplied, and the product is identified as EV Energy ev.energy.

With a CVSS score of 6.9, the flaw is considered medium severity. The EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to establish a WebSocket connection to the backend, which is likely reachable remotely; thus the attack vector is inferred to be remote client access. An attacker who can authenticate as or masquerade the WebSocket client can hijack session states or overwhelm the service with session requests.