CVE-2026-45574
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The epa4all-client library (Java Client for epa4all / ePA 3.0 in Telematik Infrastruktur) prior to version 1.2.2 does not properly validate TLS certificates. An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic, including patient identifiers (KVNR), SMC-B card operations, document content, and credential exchanges.
Risk Assessment
The risk is critical as it allows an attacker to intercept sensitive medical data and credentials, potentially leading to patient privacy breaches and unauthorized access to the ePA system.
Recommendation
Immediately update epa4all-client to version 1.2.2 or later, which contains the TLS certificate validation fix.
Other vulnerabilities in epa4all-client
See all- CVE-2026-44900High
In the epa4all-client Java client, the SignedPublicKeysTrustValidatorImpl.isTrusted() method discards the boolean return value of ECDSA signature verification, always returning true for any structurally valid signature.
- CVE-2026-47672Medium
epa4all-client version 1.2.4 and earlier allows any network-reachable caller to write arbitrary documents to any patient's electronic health record using the institution's SMC-B card. In a misconfigured deployment (e.g., following the Docker example in the README), this is exploitable from the local network without credentials.
- CVE-2026-45575High
In the epa4all-client Java client, a MITM attacker on the TLS connection between client and IDP can substitute a forged discovery document, redirecting the client to attacker-controlled URLs. The client then encrypts the SMC-B signed challenge response with the attacker's key and sends it to the attacker.
Original NVD description (English source)
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.