# CVE-2026-42952: Hydro-Québec Le Circuit Electrique improper authentication throttling

Source: https://junglewise.ai/threats/cve-2026-42952-hydro-quebec-le-circuit-electrique-improper-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-42952 · Severity: high · CVSS 7.5 · Published 2026-07-10

The backend system for Hydro-Québec's Le Circuit Electrique charging stations was found to lack rate-limiting on authentication attempts. This could allow an attacker to flood the system with login requests, potentially causing a service outage for electric vehicle charging management. Hydro-Québec has addressed this by updating charging station protocols and implementing new authentication systems.

Technologies: [Hydro-Québec Le Circuit Electrique charging station backend](https://junglewise.ai/threats/technologies/le-circuit-electrique-charging-station-backend). Vendors: [Hydro-Québec](https://junglewise.ai/threats/vendors/hydro-qu-bec).

## Quick answers

**Is CVE-2026-42952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42952 being exploited in the wild.

**How severe is CVE-2026-42952?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** Hydro-Québec Le Circuit Electrique charging station backend Before June 2026.

**Is there a fix for CVE-2026-42952?** A patch was published on 2026-06-01: Remediation implemented in June 2026 update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42952 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42952?** Check whether you run Hydro-Québec Le Circuit Electrique charging station backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). The charging station backend failed to implement throttling or rate-limiting on repeated authentication requests. A remote, unauthenticated attacker could exploit this by sending a high volume of authentication attempts to overwhelm the backend resources, resulting in a denial-of-service (DoS). Hydro-Québec has mitigated the issue by disabling the Open Charge Point Protocol (OCPP) on most stations and implementing enhanced authentication for those still requiring it.

## Affected products

- Hydro-Québec Le Circuit Electrique charging station backend Before June 2026

## Timeline

- 2026-07-07: advisory: Initial release of ICSA-26-188-01 by CISA
- 2026-07-10: disclosed: CVE published to NVD dataset
- 2026-06-01: patched: Remediation implemented in June 2026 update

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01)
- [https://www.hydroquebec.com/nous-joindre/](https://www.hydroquebec.com/nous-joindre/)

## Related threats

- [Hydro-Québec Le Circuit Electrique denial of service in charging backend](https://junglewise.ai/threats/cve-2026-44383-hydro-quebec-le-circuit-electrique-denial-of-service-in-charging)
- [Hydro-Québec Le Circuit Electrique auth bypass in charging station backend](https://junglewise.ai/threats/cve-2026-20744-hydro-quebec-le-circuit-electrique-auth-bypass-in-charging)