PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45575 oviva-ag CVE debrief

epa4all-client versions prior to 1.2.2 are vulnerable to a man-in-the-middle (MITM) attack targeting the TLS connection between the client and the Identity Provider (IDP) within the Telematik Infrastruktur (TI) network. An attacker positioned to intercept this connection can substitute a forged discovery document that redirects the `uri_puk_idp_enc` and `uri_puk_idp_sig` endpoints to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response using the attacker's encryption key and transmits it to the attacker's authentication endpoint, allowing capture of the signed authentication material. This vulnerability enables authentication bypass and credential theft in the German electronic health card (eGK) infrastructure. The issue is resolved in version 1.2.2.

Vendor
oviva-ag
Product
epa4all-client
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Healthcare IT administrators operating within the German Telematik Infrastruktur, developers integrating epa4all-client for ePA 3.0 connectivity, security teams monitoring German eHealth authentication flows, and organizations relying on SMC-B card-based authentication for electronic patient record access.

Technical summary

The epa4all-client Java library for German electronic health record (ePA 3.0) integration fails to properly validate the authenticity of IDP discovery documents retrieved over TLS. An attacker with MITM capability within the Telematik Infrastruktur network can inject a malicious discovery document that substitutes attacker-controlled public key URLs for the legitimate IDP encryption (`uri_puk_idp_enc`) and signature (`uri_puk_idp_sig`) endpoints. The client subsequently encrypts sensitive SMC-B-signed authentication challenges using the attacker's key and submits them to the attacker's endpoint, resulting in capture of valid signed authentication tokens. This represents a breakdown in the trust establishment phase of the OAuth 2.0 / OpenID Connect flow used within the German healthcare digital infrastructure.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade epa4all-client to version 1.2.2 or later
  • Verify IDP discovery document authenticity through certificate pinning or out-of-band validation
  • Monitor for anomalous authentication flows in TI network environments
  • Review network segmentation to limit MITM opportunities within TI infrastructure
  • Audit SMC-B authentication logs for unexpected encryption key references

Evidence notes

Vulnerability description confirms MITM attack vector within TI network boundary. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects network-accessible, high-complexity attack with no privileges required. CWE-347 (Improper Verification of Cryptographic Signature) assigned. Fix confirmed in pull request #36.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45575 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45575

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45575 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45575

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.