PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45575 oviva-ag CVE debrief

epa4all-client versions prior to 1.2.2 are vulnerable to a man-in-the-middle (MITM) attack targeting the TLS connection between the client and the Identity Provider (IDP) within the Telematik Infrastruktur (TI) network. An attacker positioned to intercept this connection can substitute a forged discovery document that redirects the `uri_puk_idp_enc` and `uri_puk_idp_sig` endpoints to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response using the attacker's encryption key and transmits it to the attacker's authentication endpoint, allowing capture of the signed authentication material. This vulnerability enables authentication bypass and credential theft in the German electronic health card (eGK) infrastructure. The issue is resolved in version 1.2.2.

Vendor
oviva-ag
Product
epa4all-client
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-27
Advisory published
2026-05-26
Advisory updated
2026-05-27

Who should care

Healthcare IT administrators operating within the German Telematik Infrastruktur, developers integrating epa4all-client for ePA 3.0 connectivity, security teams monitoring German eHealth authentication flows, and organizations relying on SMC-B card-based authentication for electronic patient record access.

Technical summary

The epa4all-client Java library for German electronic health record (ePA 3.0) integration fails to properly validate the authenticity of IDP discovery documents retrieved over TLS. An attacker with MITM capability within the Telematik Infrastruktur network can inject a malicious discovery document that substitutes attacker-controlled public key URLs for the legitimate IDP encryption (`uri_puk_idp_enc`) and signature (`uri_puk_idp_sig`) endpoints. The client subsequently encrypts sensitive SMC-B-signed authentication challenges using the attacker's key and submits them to the attacker's endpoint, resulting in capture of valid signed authentication tokens. This represents a breakdown in the trust establishment phase of the OAuth 2.0 / OpenID Connect flow used within the German healthcare digital infrastructure.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade epa4all-client to version 1.2.2 or later
  • Verify IDP discovery document authenticity through certificate pinning or out-of-band validation
  • Monitor for anomalous authentication flows in TI network environments
  • Review network segmentation to limit MITM opportunities within TI infrastructure
  • Audit SMC-B authentication logs for unexpected encryption key references

Evidence notes

Vulnerability description confirms MITM attack vector within TI network boundary. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects network-accessible, high-complexity attack with no privileges required. CWE-347 (Improper Verification of Cryptographic Signature) assigned. Fix confirmed in pull request #36.

Official resources

2026-05-26