# CVE-2026-20744: Hydro-Québec Le Circuit Electrique auth bypass in charging station backend

Source: https://junglewise.ai/threats/cve-2026-20744-hydro-quebec-le-circuit-electrique-auth-bypass-in-charging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-20744 · Severity: critical · CVSS 9.8 · Published 2026-07-10

The backend system for Hydro-Québec's electric vehicle charging network contains a security flaw where its communication interface does not properly verify user identity. This could allow an unauthorized person to gain administrative control over the charging station management system. Such an exploit could lead to service disruptions, unauthorized access to charging data, or manipulation of the charging infrastructure.

Technologies: [Hydro-Québec Le Circuit Electrique charging station backend](https://junglewise.ai/threats/technologies/le-circuit-electrique-charging-station-backend). Vendors: [Hydro-Québec](https://junglewise.ai/threats/vendors/hydro-qu-bec).

## Quick answers

**Is CVE-2026-20744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20744 being exploited in the wild.

**How severe is CVE-2026-20744?** Critical severity, with a CVSS score of 9.8, published 10 July 2026.

**Which products and versions are affected?** Hydro-Québec Le Circuit Electrique charging station backend Before June 2026.

**Is there a fix for CVE-2026-20744?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20744 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-20744?** Check whether you run Hydro-Québec Le Circuit Electrique charging station backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-284) exists in the WebSocket endpoint of the charging station backend, which fails to implement proper authentication for incoming connections. An unauthenticated remote attacker can connect to this endpoint and potentially escalate privileges within the system. The flaw specifically impacts the Open Charge Point Protocol (OCPP) communications. Hydro-Québec has mitigated the risk by disabling OCPP on the majority of stations and implementing new authentication systems for those still requiring it. The issue affects versions released prior to June 2026.

## Affected products

- Hydro-Québec Le Circuit Electrique charging station backend Before June 2026

## Timeline

- 2026-07-07: advisory: Initial publication by CISA (ICSA-26-188-01)
- 2026-07-10: disclosed: CVE-2026-20744 published to NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01)
- [https://www.hydroquebec.com/nous-joindre/](https://www.hydroquebec.com/nous-joindre/)

## Related threats

- [Hydro-Québec Le Circuit Electrique denial of service in charging backend](https://junglewise.ai/threats/cve-2026-44383-hydro-quebec-le-circuit-electrique-denial-of-service-in-charging)
- [Hydro-Québec Le Circuit Electrique improper authentication throttling](https://junglewise.ai/threats/cve-2026-42952-hydro-quebec-le-circuit-electrique-improper-authentication)