CVE-2026-95102 Monta WebSocket authentication bypass

CVE-2026-95102 is a missing-authentication flaw in Monta monta.app (CWE-306, CVSS 9.4) where unauthenticated OCPP WebSocket endpoints and public station identifiers allow an attacker to impersonate a charging station. The CISA advisory ICSA-26-274-02, released 1 October 2026, confirms the exposure covers monta.app vers:all/* and notes that attackers can connect without credentials because the WebSocket layer lacks authentication while station IDs are publicly discoverable. The event timeline carries two sources, radar.offseq.com and a dev.to post by max_bayern, both pointing to the same advisory and describing the mechanism as missing auth on WebSockets rather than a code-level injection.

A successful impersonation does not just disrupt billing; it places an attacker inside the OCPP message flow between station and central system, letting them inject false session start/stop events, alter tariff data, or redirect power allocations across the charging network. The advisory lists no fixed version and states only that Monta is working to increase adoption of authenticated connections on a rolling basis, which means every operator running unpatched monta.app is exposed today. The score of 5.2 reflects limited news pickup (two sources, zero Reddit signal), but the infrastructure impact is concentrated: EV charging is a small, high-value sector, and a 9.4-rated unauth endpoint in that sector deserves more attention than generic web vulnerabilities because the victim surface is physical infrastructure with direct revenue and grid ties.

Defenders should treat this as a network-boundary issue first. The CISA mitigation text specifies enabling OCPP 1.6 Security Profile 2 (HTTP Basic Auth with TLS) and restricting remote access to VPN paths; operators should verify that WebSocket ports on station gateways are not exposed to public ranges and that station IDs are not discoverable from unauthenticated endpoints. Hunting should focus on anomalous OCPP session initialization messages originating from unknown source IPs and mismatched station ID pairs in session logs, since impersonation requires the attacker to present a valid public station identifier. There is no vendor patch version listed yet, so the immediate remediation is authentication enablement and endpoint restriction, not a binary upgrade.

The assessment changes if Monta publishes a fixed release with version-specific patch notes, or if exploitation telemetry appears showing active session injection in the wild. Until then, the combination of an unpatched all-version product, a 9.4 CVSS, and a CISA advisory without a patch link makes this a persistent exposure for charging operators rather than a resolved incident.