EVerest, an electric‑vehicle charging stack, has a flaw in which processing a WithdrawAuthorization request before a TransactionStarted event causes the system to mark the transaction as inactive but fails to stop the charger. As a result, the charger can keep supplying power even after the authorization has been withdrawn, potentially leading to unintended energy draw and safety risks.

The vulnerability affects the EVerest core component (everest-core). All installations running versions earlier than 2026.02.0 are impacted. Version 2026.02.0 contains a patch that corrects the logic and ensures that a withdrawal of authorization stops the charger.

The CVSS score of 5 indicates a medium severity. EPSS is less than 1%, suggesting that exploitation is likely rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to send a WithdrawAuthorization request prior to the TransactionStarted event, likely through the network interface that controls charging commands. No direct remote code execution is possible; the risk is limited to continued charging beyond the expected authorization period.