CVE-2026-22093

Name of the Vulnerable Software and Affected Versions EVbee Service version 1.4.101.00

Description The Android application uses HTTPS for communication but fails to validate the server certificate. This flaw allows an attacker positioned on the network path to intercept and manipulate traffic between the app and the server. Additionally, the communication is weakly encrypted using the RC4 stream cipher with a hardcoded key, which can be bypassed to gain access to sensitive data, including access codes for charging stations.

Recommendations Update EVbee Service version 1.4.101.00 to a version that implements proper SSL/TLS certificate validation and replaces the hardcoded RC4 encryption with a secure encryption standard.