GitHub Advisoryadvisory · Maven

GHSA-g8r3-5hwf-qp96 epa4all-client has a VAU Signature bypass

HIGH Published 2026-05-08 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-44900
Ecosystem
Maven
Packages
com.oviva.telematik:epa4all-client
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-05-08

Affected packages

• Maven com.oviva.telematik:epa4all-client: < 1.2.1 → fixed in 1.2.1

Description

Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true. Patches Patched in #34. Workarounds None. Resources • MS-OVIVA-EPA4ALL-d76aec Credits Machine Spirits ([email protected]) • Dr. rer. nat. Simon Weber • Dipl.-Inf. Volker Schönefeld • Chiara Fliegner

Related

Alias · CVE (1)

  • CVE-2026-44900 epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References