CVE-2026-22093

The record

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.

Affected packages

Related vulnerabilities

• CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the… CWE-295
• CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider… CWE-295
• CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend… CWE-295
• CVE-2026-114406 The system certificate authority (CA) store in Red Hat products, distributed via… CWE-295
• CVE-2026-95210 Improper certificate validation in gnutls v3.8.13 causes the application to accept… CWE-295
• CVE-2026-97687 urllib3 is an HTTP client library for Python. CWE-295
• CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a… CWE-295
• CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-295