The WebSocket backend for Mobiliti e‑mobi.hu creates session identifiers based on charging station identifiers, but does not enforce uniqueness. As a result, multiple devices can connect with the same session ID, producing predictable identifiers that an attacker can exploit. The most recent connection displaces the legitimate station and receives any backend commands queued for that station. This allows an unauthorized user to impersonate another charging station or to send malicious commands. If the attacker repeatedly opens sessions, the backend can be saturated, producing a denial‑of‑service condition for legitimate users.

The vulnerability affects the Mobiliti e‑mobi.hu WebSocket backend, which provides management for electric vehicle charging stations. No specific version information is available in the CVE report, so any deployment of this product may be impacted until a vendor fix is released.

With a CVSS score of 6.9, the issue is rated medium severity. The EPSS score is below 1 %, indicating a very low but non‑zero probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote attacker who can access the WebSocket endpoint; by sending a legitimate session request with a predictable session ID, the attacker can hijack the session and issue commands or overload the backend with requests.