CVE-2026-1815 - Vulnerability Details - OpenCVE

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Turkiye Electricity Transmission Corporation	Mobile Application

No data.

No data.

References

Link	Providers
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286

History

Fri, 22 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Turkiye Electricity Transmission Corporation Turkiye Electricity Transmission Corporation mobile Application
Vendors & Products		Turkiye Electricity Transmission Corporation Turkiye Electricity Transmission Corporation mobile Application

Thu, 21 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 21 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13.
Title		Session Hijacking in TEİAŞ's Mobile Application
Weaknesses		CWE-613
References		https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286
Metrics		cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2026-05-21T13:56:16.733Z

Updated: 2026-05-21T14:38:08.702Z

Reserved: 2026-02-03T14:06:49.089Z

Link: CVE-2026-1815

Vulnrichment

Updated: 2026-05-21T14:38:04.345Z

NVD

Status : Deferred

Published: 2026-05-21T15:16:22.413

Modified: 2026-05-21T15:24:41.890

Link: CVE-2026-1815

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1815", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-02-03T14:06:49.089Z", "datePublished": "2026-05-21T13:56:16.733Z", "dateUpdated": "2026-05-21T14:38:08.702Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-05-21T13:58:23.167Z"}, "title": "Session Hijacking in TE\u0130A\u015e's Mobile Application", "datePublic": "2026-05-21T13:42:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613 Insufficient session expiration", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-593", "descriptions": [{"lang": "en", "value": "CAPEC-593 Session Hijacking"}]}], "affected": [{"vendor": "Turkiye Electricity Transmission Corporation (TE\u0130A\u015e)", "product": "Mobile Application", "versions": [{"status": "affected", "version": "1.6.2", "lessThan": "1.13", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TE\u0130A\u015e) Mobile Application allows Session Hijacking.\n\nThis issue affects Mobile Application: from 1.6.2 before 1.13.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TE\u0130A\u015e) Mobile Application allows Session Hijacking.<p>This issue affects Mobile Application: from 1.6.2 before 1.13.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Metin \u00d6GTEM", "type": "finder"}], "source": {"defect": ["TR-26-0286"], "advisory": "TR-26-0286", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T14:37:42.223719Z", "id": "CVE-2026-1815", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T14:38:08.702Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T14:37:42.223719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T14:38:04.345Z"}}], "cna": {"title": "Session Hijacking in TE\u0130A\u015e's Mobile Application", "source": {"defect": ["TR-26-0286"], "advisory": "TR-26-0286", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Metin \u00d6GTEM"}], "impacts": [{"capecId": "CAPEC-593", "descriptions": [{"lang": "en", "value": "CAPEC-593 Session Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Turkiye Electricity Transmission Corporation (TE\u0130A\u015e)", "product": "Mobile Application", "versions": [{"status": "affected", "version": "1.6.2", "lessThan": "1.13", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-05-21T13:42:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TE\u0130A\u015e) Mobile Application allows Session Hijacking.\n\nThis issue affects Mobile Application: from 1.6.2 before 1.13.", "supportingMedia": [{"type": "text/html", "value": "Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TE\u0130A\u015e) Mobile Application allows Session Hijacking.<p>This issue affects Mobile Application: from 1.6.2 before 1.13.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient session expiration"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-05-21T13:58:23.167Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1815", "state": "PUBLISHED", "dateUpdated": "2026-05-21T14:38:08.702Z", "dateReserved": "2026-02-03T14:06:49.089Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-05-21T13:56:16.733Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}