CVE-2026-97212

Monta’s WebSocket backend associates charging sessions with station identifiers but still lets more than one endpoint connect with the same session identifier, which makes those identifiers predictable. A remote attacker who can reach the backend can reuse a known or guessed session identifier without prior authentication. That can let them authenticate as another user, with limited confidentiality and integrity impact, or open many valid sessions and exhaust the backend in a denial of service. Operators and users of the Monta (monta.app) charging platform are affected; specific product versions are not listed in the advisory data. It is not in CISA KEV and no public proof-of-concept is known.

What to do: Treat this as an unauthenticated session-confusion issue on the charging WebSocket backend: restrict who can open those sockets, watch for many connections reusing one session or station identifier, and apply Monta’s fix as soon as a patched release is published. Until then, review logs for unexpected session reuse, cross-user charging actions, and floods of otherwise valid session requests.