CVE-2026-50577 fbeta-GmbH CVE debrief

Who should care

Defenders responsible for ePA 3.x Integration systems, including security teams, vulnerability management teams, and operators of affected platforms, should assess exposure and prioritize upgrading to version 1.3.0 or later. Additionally, teams responsible for monitoring, detection, and incident response should be aware of the potential impacts of this vulnerability and take steps to verify the integrity of patient health records.

Why it matters

Defenders should prioritize upgrading to version 1.3.0 or later and verifying the integrity of patient health records due to the vulnerability in ePA 3.x Integration prior to version 1.3.0.

• Sensitive data recovery through repeated ciphertexts
• Predictable inner HTTP headers and JSON fields allow health record recovery
• AES-GCM nonce and key combination reuse enables GHASH authentication key recovery
• Replay and ordering validation weakening

Technical summary

The vulnerability is caused by a frozen client request counter in ePA 3.x Integration prior to version 1.3.0, which enables the reuse of AES-GCM nonce and key combinations across responses. This allows a network attacker to recover sensitive data, including patient health records, by collecting repeated ciphertexts and using predictable inner HTTP headers and JSON fields. The issue also weakens replay and ordering validation, and enables recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses.

Defensive priority

Defenders should prioritize upgrading to version 1.3.0 or later and verifying the integrity of patient health records.

Recommended defensive actions

• Upgrade to version 1.3.0 or later
• Verify the integrity of patient health records
• Monitor for repeated ciphertexts and predictable inner HTTP headers and JSON fields
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a frozen client request counter in ePA 3.x Integration prior to version 1.3.0, which enables the reuse of AES-GCM nonce and key combinations across responses. This issue allows a network attacker to recover sensitive data, including patient health records, by collecting repeated ciphertexts and using predictable inner HTTP headers and JSON fields. The GHASH authentication key can also be recovered through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.