CVE-2025-68140 MEDIUM

CVE-2025-68140: EVerest allows null session ID to bypass session ID verification

Vendor Everest

Product everest-core

Weakness CWE-863 · Incorrect authorization

Published January 21, 2026

Last update January 22, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

Key dates

02Disclosure timeline

January 21, 2026 CVE published

January 22, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-68140 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html