CVE-2025-68140CWE-863

EVerest allows null session ID to bypass session ID verification

Medium · published January 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-01-21T19:54Z
EPSS history
Timeline
  • 21 JAN 19:54Z
    EVerest allows null session ID to bypass session ID verification
    cvelistv5