The WebSocket Application Programming Interface lacks restrictions on
the number of authentication requests. This absence of rate limiting may
allow an attacker to conduct denial-of-service attacks by suppressing
or mis-routing legitimate charger telemetry, or conduct brute-force
attacks to gain unauthorized access.
Published: 2026-02-27
CVSS: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Download Exploit for CVE-2026-26305 here:
Use Tor Browser to access .onion site.
https://sonitex.com/exploit-453-cve-2026-27971/
https://sonitex.com/exploit-321-cve-2026-3289/
https://sonitex.com/exploit-494-cve-2025-40931/