epa4all-client: TLS Certificate Validation Disabled in Production
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oviva-ag | epa4all-client | before 1.2.2 | 1.2.2 | Patch available | CNA |
| com.oviva.telematik | epa4all-client | before 1.2.2 | 1.2.2 | Patch available | CNA |
| — | com.oviva.telematik:epa4all-client (Maven) | before 1.2.2 | 1.2.2 | Patch available | GHSA-5hhf-xmfx-4vvr |
- epa4all-client Vendoroviva-ag Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- epa4all-client Vendorcom.oviva.telematik Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- com.oviva.telematik:epa4all-client (Maven) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-5hhf-xmfx-4vvr
Remediation
- Fix · CNA epa4all-client (oviva-ag) Fixed in 1.2.2
- Fix · CNA epa4all-client (com.oviva.telematik) Fixed in 1.2.2
- Fix · GHSA-5hhf-xmfx-4vvr com.oviva.telematik:epa4all-client (Maven) Fixed in 1.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45574
- 2026-10-03 Alias added: GHSA-5hhf-xmfx-4vvr
References
Other 5
- https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr
- https://github.com/oviva-ag/epa4all-client/pull/36
- https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32
- https://github.com/oviva-ag/epa4all-client
- https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2
More oviva-ag vulnerabilities
- TI-2026-32775 epa4all-client: VAU Signature bypass CVSS 3.1HIGH 8.1
- TI-2026-33324 epa4all-client: Improper Verification of Cryptographic Signature CVSS 3.1HIGH 7.4
- TI-2026-35179 epa4all-client: Unauthenticated REST API for Patient Record Writes CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-45574 · CVE Program
- CVE-2026-45574 · NVD
- FIRST EPSS
- GHSA-5hhf-xmfx-4vvr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences