# CVE-2026-93474: Monta monta.app information disclosure in charging station identifiers

Source: https://junglewise.ai/threats/cve-2026-93474-charging-station-authentication-identifiers-are-publicly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-93474 · Severity: medium · CVSS 6.5 · Published 2026-10-02

Monta monta.app is a platform that manages electric vehicle charging stations worldwide. Charging station authentication identifiers are publicly accessible through web-based mapping platforms, allowing attackers to discover and interact with specific charging stations without authorization. This exposure could enable unauthorized access to charging services, manipulation of charging operations, or service disruption.

Technologies: [Monta.App](https://junglewise.ai/threats/technologies/monta-app). Vendors: [Monta](https://junglewise.ai/threats/vendors/monta).

## Quick answers

**Is CVE-2026-93474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93474 being exploited in the wild.

**How severe is CVE-2026-93474?** Medium severity, with a CVSS score of 6.5, published 2 October 2026.

**Which products and versions are affected?** Monta.App all versions.

**Is there a fix for CVE-2026-93474?** No fixed version is recorded yet. Monta advises operators to enable OCPP 1.6 Security Profile 2 with HTTP Basic Auth over TLS to enforce authentication on connections. Additionally, implement network-level restrictions to limit which mapping platforms or services can enumerate charging station locations and identifiers. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93474 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93474?** Check whether you run Monta.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Monta advises operators to enable OCPP 1.6 Security Profile 2 with HTTP Basic Auth over TLS to enforce authentication on connections. Additionally, implement network-level restrictions to limit which mapping platforms or services can enumerate charging station locations and identifiers.

## Technical details

CVE-2026-93474 represents an information disclosure vulnerability where charging station identifiers used for authentication are exposed via public web-based mapping platforms. The identifiers appear to be predictable or enumerable, allowing attackers to discover valid station IDs and potentially exploit them in conjunction with other weaknesses such as missing authentication checks on WebSocket endpoints (CVE-2026-95102) or weak session management (CVE-2026-97212). Network-based attack vector with no authentication or user interaction required.

## Affected products

- Monta monta.app all versions

## Timeline

- 2026-10-01: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02)

## Related threats

- [Monta monta.app WebSocket authentication rate limiting bypass](https://junglewise.ai/threats/cve-2026-97363-the-websocket-application-programming-interface-lacks)
- [Monta monta.app session prediction and reuse in WebSocket](https://junglewise.ai/threats/cve-2026-97212-the-websocket-backend-uses-charging-station-identifiers-to)
- [Monta monta.app authentication and session management vulnerabilities](https://junglewise.ai/threats/cve-2026-95102-monta-monta-app)