CVE-2026-29044: EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines transactionactive=false and only calls withdrawauthorizationcallback. This path ultimately calls Charger::deauthorize(), but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29044?
CVE-2026-29044 is classified as a medium severity vulnerability.
How do I fix CVE-2026-29044?
To fix CVE-2026-29044, upgrade your EVerest software to version 2026.02.0 or later.
What systems are affected by CVE-2026-29044?
CVE-2026-29044 affects all versions of EVerest prior to 2026.02.0.
What is the impact of CVE-2026-29044?
The impact of CVE-2026-29044 is that charging may continue erroneously when authorization withdrawal is processed before the transaction starts.
Is there a workaround for CVE-2026-29044?
Currently, there are no specified workarounds for CVE-2026-29044; upgrading to the latest version is recommended.