Executive brief
A security flaw in the epa4all-client, a tool used for electronic patient records in the German Telematik Infrastructure, allows attackers to intercept sensitive medical data. By positioning themselves on the local network, an attacker can bypass encryption to view patient identifiers, medical documents, and digital signatures. This could lead to the exposure of private health information and the unauthorized use of medical identity cards.
Technical details
The epa4all-client library (and its associated REST service) suffers from improper certificate validation (CWE-295). Prior to version 1.2.2, the client does not verify the authenticity of TLS certificates presented by the Konnektor or ePA service, accepting self-signed, expired, or mismatched certificates. An attacker with adjacent network access can perform a Man-in-the-Middle (MitM) attack to intercept SOAP traffic. This traffic contains sensitive data such as patient identifiers (KVNR), document content, and SMC-B card operations (authentication and signing). The vulnerability was addressed in version 1.2.2 by enabling truststore validation by default.
Affected products
- oviva-ag epa4all-client < 1.2.2
- oviva-ag epa4all-rest-service (Docker) < 1.2.2
Timeline
- 2026-05-08: patched: Fix merged into main branch via Pull Request 36
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE-2026-45574 published to NVD