Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M

CVE-2025-68140EVerest allows null session ID to bypass session ID verification

Medium 4.3

In plain English

A medium-severity incorrect authorization in everest-core from EVerest. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
EVerest	everest-core	< 2025.9.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/EVerest/everest-core/security/advisories/GHSA-w385-3jwp-x47x x_refsource_CONFIRM