CVE-2026-50576 fbeta-GmbH CVE debrief

Who should care

Defenders responsible for ePA 3.x Integration systems, particularly those handling patient records, should assess exposure and prioritize verification and remediation efforts to prevent potential security breaches. This includes verifying and upgrading to version 1.3.0, assessing exposure, and implementing compensating controls to mitigate potential security risks.

Why it matters

CVE-2026-50576 allows an authenticated attacker to inject headers into inner HTTP requests, potentially exposing patient records or bypassing authentication. Defenders should prioritize verification, upgrading to version 1.3.0, assessing exposure, and implementing compensating controls.

• Potential exposure of patient records
• Possible bypass of authentication or authorization context
• Poisoning of requests across the session

Technical summary

The ePA 3.x Integration does not neutralize CRLF characters in values used to construct VAU inner HTTP requests, allowing an authenticated attacker to inject additional headers. This can lead to potential exposure of patient records or bypassing of authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. The vulnerability is fixed in version 1.3.0 and defenders should prioritize verification and remediation efforts to prevent potential security breaches.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.3.0, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify and upgrade to version 1.3.0
• Assess exposure and implement compensating controls
• Monitor for suspicious activity
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 1.3.0. The ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers, as

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.