GitHub Advisoryadvisory · Maven

GHSA-gqx7-6552-67hf Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

HIGH Published 2026-05-15 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-45575
Ecosystem
Maven
Packages
com.oviva.telematik:epa4all-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-347
Reviewed
2026-05-15

Affected packages

• Maven com.oviva.telematik:epa4all-client: < 1.2.2 → fixed in 1.2.2

Description

Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material. Patches #36 Workarounds None. Resources • MS-OVIVA-EPA4ALL-d453c1 Credits Machine Spirits ([email protected]) • Dr. rer. nat. Simon Weber • Dipl.-Inf. Volker Schönefeld • Chiara Fliegner

Related

Alias · CVE (1)

  • CVE-2026-45575 epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References