CVE-2026-32663mediumCWE-613

CVE-2026-32663: medium-severity vulnerability in IGL-Technologies eParking.fi

IGL-Technologies eParking.fi Insufficient Session Expiration

Published · Updated

Follow this CVE+ Monitor eParking.fi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
IGL-Technologies · eParking.fi
Related CVEs — IGL-Technologies eParking.fi

In the same product, most dangerous first.

CVE-2026-29796CRITICALIGL-Technologies eParking.fi Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-31903HIGHIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-31926MEDIUMIGL-Technologies eParking.fi Insufficiently Protected CredentialsEPSS 0.3%