GitHub Advisoryadvisory · Maven

GHSA-5hhf-xmfx-4vvr epa4all-client: TLS Certificate Validation Disabled in Production

HIGH Published 2026-05-15 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-45574
Ecosystem
Maven
Packages
com.oviva.telematik:epa4all-client
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-05-15

Affected packages

• Maven com.oviva.telematik:epa4all-client: < 1.2.2 → fixed in 1.2.2

Description

Impact An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. Patches #36 Workarounds Use the library directly instead of the REST wrapper. Resources • MS-OVIVA-EPA4ALL-771a78 Credits Machine Spirits ([email protected]) • Dr. rer. nat. Simon Weber • Dipl.-Inf. Volker Schönefeld • Chiara Fliegner

Related

Alias · CVE (1)

  • CVE-2026-45574 epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References