epa4all-client: Improper Verification of Cryptographic Signature
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects uri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material. This vulnerability is fixed in 1.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oviva-ag | epa4all-client | before 1.2.2 | 1.2.2 | Patch available | CNA |
| com.oviva.telematik | epa4all-client | before 1.2.2 | 1.2.2 | Patch available | CNA |
| — | com.oviva.telematik:epa4all-client (Maven) | before 1.2.2 | 1.2.2 | Patch available | GHSA-gqx7-6552-67hf |
- epa4all-client Vendoroviva-ag Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- epa4all-client Vendorcom.oviva.telematik Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- com.oviva.telematik:epa4all-client (Maven) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-gqx7-6552-67hf
Remediation
- Fix · CNA epa4all-client (oviva-ag) Fixed in 1.2.2
- Fix · CNA epa4all-client (com.oviva.telematik) Fixed in 1.2.2
- Fix · GHSA-gqx7-6552-67hf com.oviva.telematik:epa4all-client (Maven) Fixed in 1.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45575
- 2026-10-03 Alias added: GHSA-gqx7-6552-67hf
References
Other 5
- https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf
- https://github.com/oviva-ag/epa4all-client/pull/36
- https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32
- https://github.com/oviva-ag/epa4all-client
- https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2
More oviva-ag vulnerabilities
- TI-2026-33323 epa4all-client: TLS Certificate Validation Disabled in Production CVSS 3.1HIGH 8.1
- TI-2026-32775 epa4all-client: VAU Signature bypass CVSS 3.1HIGH 8.1
- TI-2026-35179 epa4all-client: Unauthenticated REST API for Patient Record Writes CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-45575 · CVE Program
- CVE-2026-45575 · NVD
- FIRST EPSS
- GHSA-gqx7-6552-67hf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences