A critical vulnerability was found in ePA 3.x Integration prior to version 1.3.0, allowing a network-positioned attacker to impersonate the VAU server, control session keys, and read or modify encrypted VAU traffic due to improper VAU server certificate validation and disabled TLS certificate verification. This issue arises from the integration's failure to anchor the signed_vau_server_pub_keys and AUT_VA [truncated]
A vulnerability in ePA 3.x Integration prior to version 1.3.0 allows a network-positioned attacker to intercept ePA traffic by presenting an arbitrary certificate and terminating the TLS connection. This issue is due to the disabling of TLS certificate verification for both ePA and Konnektor connections. The ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects t [truncated]
A vulnerability in ePA 3.x Integration prior to version 1.3.0 allows a network attacker to recover sensitive data, including patient health records, by collecting repeated ciphertexts and using predictable inner HTTP headers and JSON fields. The issue is caused by the frozen client request counter, which enables the reuse of AES-GCM nonce and key combinations across responses.
CVE-2026-50576 is a vulnerability in ePA 3.x Integration that allows an authenticated attacker to inject additional headers into inner HTTP requests, potentially exposing patient records or bypassing authentication. The vulnerability arises from the lack of neutralization of CRLF characters in values used to construct VAU inner HTTP requests. This issue is fixed in version 1.3.0. Defenders should prioriti [truncated]
