# CVE-2026-45574: Oviva epa4all-client improper TLS certificate validation

Source: https://junglewise.ai/threats/cve-2026-45574-oviva-epa4all-client-improper-tls-certificate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-45574 · Severity: high · CVSS 8.1 · Published 2026-05-26

A security flaw in the epa4all-client, a tool used for electronic patient records in the German Telematik Infrastructure, allows attackers to intercept sensitive medical data. By positioning themselves on the local network, an attacker can bypass encryption to view patient identifiers, medical documents, and digital signatures. This could lead to the exposure of private health information and the unauthorized use of medical identity cards.

Technologies: [com.oviva.telematik:epa4all-client (Maven)](https://junglewise.ai/threats/technologies/com-oviva-telematik-epa4all-client), [Oviva Epa4all-Rest-Service](https://junglewise.ai/threats/technologies/epa4all-rest-service), [Oviva AG Epa4all-Client](https://junglewise.ai/threats/technologies/epa4all-client). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Oviva](https://junglewise.ai/threats/vendors/oviva), [Oviva AG](https://junglewise.ai/threats/vendors/oviva-ag).

## Quick answers

**Is CVE-2026-45574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45574 being exploited in the wild.

**How severe is CVE-2026-45574?** High severity, with a CVSS score of 8.1, published 26 May 2026.

**Which products and versions are affected?** com.oviva.telematik:epa4all-client (Maven) < 1.2.2, ECOSYSTEM:introduced=0,fixed=1.2.2; Oviva Epa4all-Rest-Service < 1.2.2; Oviva AG Epa4all-Client < 1.2.2.

**Is there a fix for CVE-2026-45574?** Yes. com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45574 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-45574?** Check whether you run com.oviva.telematik:epa4all-client (Maven), Oviva Epa4all-Rest-Service or Oviva AG Epa4all-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later

  ```sh
  # set com.oviva.telematik:epa4all-client to 1.2.2 in your pom.xml or build.gradle
  ```


## Technical details

The epa4all-client library (and its associated REST service) suffers from improper certificate validation (CWE-295). Prior to version 1.2.2, the client does not verify the authenticity of TLS certificates presented by the Konnektor or ePA service, accepting self-signed, expired, or mismatched certificates. An attacker with adjacent network access can perform a Man-in-the-Middle (MitM) attack to intercept SOAP traffic. This traffic contains sensitive data such as patient identifiers (KVNR), document content, and SMC-B card operations (authentication and signing). The vulnerability was addressed in version 1.2.2 by enabling truststore validation by default.

## Affected products

- oviva-ag epa4all-client < 1.2.2
- oviva-ag epa4all-rest-service (Docker) < 1.2.2

## Identifiers

- CVE-2026-45574
- GHSA-5hhf-xmfx-4vvr

## Timeline

- 2026-05-08: patched: Fix merged into main branch via Pull Request 36
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE-2026-45574 published to NVD

## References

- [https://github.com/oviva-ag/epa4all-client/pull/36](https://github.com/oviva-ag/epa4all-client/pull/36)
- [https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr](https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr)

## Related threats

- [Oviva epa4all-client signature bypass in SignedPublicKeysTrustValidator](https://junglewise.ai/threats/cve-2026-44900-oviva-epa4all-client-signature-bypass-in)
- [Oviva epa4all-client missing authentication for patient record writes](https://junglewise.ai/threats/cve-2026-47672-oviva-epa4all-client-missing-authentication-for-patient-record)
- [oviva-ag epa4all-client signature verification bypass in IDP discovery](https://junglewise.ai/threats/cve-2026-45575-oviva-ag-epa4all-client-signature-verification-bypass-in-idp)