# CVE-2026-97212: Monta monta.app session prediction and reuse in WebSocket

Source: https://junglewise.ai/threats/cve-2026-97212-the-websocket-backend-uses-charging-station-identifiers-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-97212 · Severity: high · CVSS 7.3 · Published 2026-10-02

Monta's charging station management platform uses predictable session identifiers in its WebSocket backend, allowing attackers to hijack sessions belonging to other charging stations. An attacker could impersonate legitimate stations to intercept commands, steal data, or trigger denial-of-service attacks against the charging network.

Technologies: [Monta.App](https://junglewise.ai/threats/technologies/monta-app). Vendors: [Monta](https://junglewise.ai/threats/vendors/monta).

## Quick answers

**Is CVE-2026-97212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97212 being exploited in the wild.

**How severe is CVE-2026-97212?** High severity, with a CVSS score of 7.3, published 2 October 2026.

**Which products and versions are affected?** Monta.App all.

**Is there a fix for CVE-2026-97212?** No fixed version is recorded yet. Monta recommends enabling OCPP 1.6 Security Profile 2 with HTTP Basic Auth and TLS. The platform also implements rate limiting and automated connection throttling to block connections exhibiting rapid reconnection, ID brute-forcing, or excessive command volume.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97212 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97212?** Check whether you run Monta.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Monta recommends enabling OCPP 1.6 Security Profile 2 with HTTP Basic Auth and TLS. The platform also implements rate limiting and automated connection throttling to block connections exhibiting rapid reconnection, ID brute-forcing, or excessive command volume.</anigation>
</invoke>

## Technical details

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same identifier, resulting in predictable and reusable session tokens. An unauthenticated attacker can craft requests over the network to hijack sessions or exhaust backend resources. The vulnerability enables unauthorized authentication as other users and denial-of-service via session flooding.

## Affected products

- Monta monta.app all

## Timeline

- 2026-10-01: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02)

## Related threats

- [Monta monta.app WebSocket authentication rate limiting bypass](https://junglewise.ai/threats/cve-2026-97363-the-websocket-application-programming-interface-lacks)
- [Monta monta.app authentication and session management vulnerabilities](https://junglewise.ai/threats/cve-2026-95102-monta-monta-app)
- [Monta monta.app information disclosure in charging station identifiers](https://junglewise.ai/threats/cve-2026-93474-charging-station-authentication-identifiers-are-publicly)