Search criteria

4 vulnerabilities by oviva-ag

CVE-2026-44900 (GCVE-0-2026-44900)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:04 – Updated: 2026-05-26 21:04
VLAI
Title
epa4all-client: VAU Signature bypass
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true. This vulnerability is fixed in 1.2.1.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "epa4all-client",
          "vendor": "oviva-ag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        },
        {
          "product": "epa4all-client",
          "vendor": "com.oviva.telematik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in  SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true.  This vulnerability is fixed in 1.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:04:53.961Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-g8r3-5hwf-qp96",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-g8r3-5hwf-qp96"
        },
        {
          "name": "https://github.com/oviva-ag/epa4all-client/pull/34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/pull/34"
        }
      ],
      "source": {
        "advisory": "GHSA-g8r3-5hwf-qp96",
        "discovery": "UNKNOWN"
      },
      "title": "epa4all-client: VAU Signature bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44900",
    "datePublished": "2026-05-26T21:04:53.961Z",
    "dateReserved": "2026-05-07T21:50:33.546Z",
    "dateUpdated": "2026-05-26T21:04:53.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45574 (GCVE-0-2026-45574)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:03 – Updated: 2026-05-27 13:21
VLAI
Title
epa4all-client: TLS Certificate Validation Disabled in Production
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45574",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T13:20:59.307934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T13:21:07.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "epa4all-client",
          "vendor": "oviva-ag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.2"
            }
          ]
        },
        {
          "product": "epa4all-client",
          "vendor": "com.oviva.telematik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:03:15.152Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr"
        },
        {
          "name": "https://github.com/oviva-ag/epa4all-client/pull/36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/pull/36"
        }
      ],
      "source": {
        "advisory": "GHSA-5hhf-xmfx-4vvr",
        "discovery": "UNKNOWN"
      },
      "title": "epa4all-client: TLS Certificate Validation Disabled in Production"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45574",
    "datePublished": "2026-05-26T21:03:15.152Z",
    "dateReserved": "2026-05-12T19:00:14.600Z",
    "dateUpdated": "2026-05-27T13:21:07.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45575 (GCVE-0-2026-45575)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:01 – Updated: 2026-05-26 21:01
VLAI
Title
epa4all-client: Improper Verification of Cryptographic Signature
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects uri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material. This vulnerability is fixed in 1.2.2.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "epa4all-client",
          "vendor": "oviva-ag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.2"
            }
          ]
        },
        {
          "product": "epa4all-client",
          "vendor": "com.oviva.telematik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects uri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker\u0027s encryption key and POSTs it to the attacker\u0027s auth endpoint. This captures the signed authentication material. This vulnerability is fixed in 1.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:01:51.745Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf"
        },
        {
          "name": "https://github.com/oviva-ag/epa4all-client/pull/36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/pull/36"
        }
      ],
      "source": {
        "advisory": "GHSA-gqx7-6552-67hf",
        "discovery": "UNKNOWN"
      },
      "title": "epa4all-client: Improper Verification of Cryptographic Signature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45575",
    "datePublished": "2026-05-26T21:01:51.745Z",
    "dateReserved": "2026-05-12T19:00:14.600Z",
    "dateUpdated": "2026-05-26T21:01:51.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47672 (GCVE-0-2026-47672)

Vulnerability from cvelistv5 – Published: 2026-05-26 20:59 – Updated: 2026-05-27 14:16
VLAI
Title
epa4all-client: Unauthenticated REST API for Patient Record Writes
Summary
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.
Severity
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Vendor Product Version
oviva-ag epa4all-client Affected: <= 1.2.4
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T14:16:09.341111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T14:16:18.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "epa4all-client",
          "vendor": "oviva-ag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient\u0027s electronic health record accessible by the institution\u0027s SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T20:59:44.795Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-c82x-f4xr-qv33",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-c82x-f4xr-qv33"
        },
        {
          "name": "https://github.com/oviva-ag/epa4all-client/pull/43",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oviva-ag/epa4all-client/pull/43"
        }
      ],
      "source": {
        "advisory": "GHSA-c82x-f4xr-qv33",
        "discovery": "UNKNOWN"
      },
      "title": "epa4all-client: Unauthenticated REST API for Patient Record Writes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47672",
    "datePublished": "2026-05-26T20:59:44.795Z",
    "dateReserved": "2026-05-19T21:10:38.797Z",
    "dateUpdated": "2026-05-27T14:16:18.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}