PatchSiren cyber security CVE debrief
CVE-2026-45575 oviva-ag CVE debrief
epa4all-client versions prior to 1.2.2 are vulnerable to a man-in-the-middle (MITM) attack targeting the TLS connection between the client and the Identity Provider (IDP) within the Telematik Infrastruktur (TI) network. An attacker positioned to intercept this connection can substitute a forged discovery document that redirects the `uri_puk_idp_enc` and `uri_puk_idp_sig` endpoints to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response using the attacker's encryption key and transmits it to the attacker's authentication endpoint, allowing capture of the signed authentication material. This vulnerability enables authentication bypass and credential theft in the German electronic health card (eGK) infrastructure. The issue is resolved in version 1.2.2.
- Vendor
- oviva-ag
- Product
- epa4all-client
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-27
Who should care
Healthcare IT administrators operating within the German Telematik Infrastruktur, developers integrating epa4all-client for ePA 3.0 connectivity, security teams monitoring German eHealth authentication flows, and organizations relying on SMC-B card-based authentication for electronic patient record access.
Technical summary
The epa4all-client Java library for German electronic health record (ePA 3.0) integration fails to properly validate the authenticity of IDP discovery documents retrieved over TLS. An attacker with MITM capability within the Telematik Infrastruktur network can inject a malicious discovery document that substitutes attacker-controlled public key URLs for the legitimate IDP encryption (`uri_puk_idp_enc`) and signature (`uri_puk_idp_sig`) endpoints. The client subsequently encrypts sensitive SMC-B-signed authentication challenges using the attacker's key and submits them to the attacker's endpoint, resulting in capture of valid signed authentication tokens. This represents a breakdown in the trust establishment phase of the OAuth 2.0 / OpenID Connect flow used within the German healthcare digital infrastructure.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade epa4all-client to version 1.2.2 or later
- Verify IDP discovery document authenticity through certificate pinning or out-of-band validation
- Monitor for anomalous authentication flows in TI network environments
- Review network segmentation to limit MITM opportunities within TI infrastructure
- Audit SMC-B authentication logs for unexpected encryption key references
Evidence notes
Vulnerability description confirms MITM attack vector within TI network boundary. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects network-accessible, high-complexity attack with no privileges required. CWE-347 (Improper Verification of Cryptographic Signature) assigned. Fix confirmed in pull request #36.
Official resources
2026-05-26