# CVE-2026-45575: oviva-ag epa4all-client signature verification bypass in IDP discovery

Source: https://junglewise.ai/threats/cve-2026-45575-oviva-ag-epa4all-client-signature-verification-bypass-in-idp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-45575 · Severity: high · CVSS 7.4 · Published 2026-05-26

The epa4all-client is a Java-based tool used to connect to the German electronic patient record (ePA) infrastructure. A security flaw allows an attacker who can intercept network traffic to trick the client into sending sensitive authentication data to a server they control. This could lead to the theft of digital credentials used by healthcare providers to access patient records, potentially compromising patient privacy and system integrity.

Technologies: [com.oviva.telematik:epa4all-client (Maven)](https://junglewise.ai/threats/technologies/com-oviva-telematik-epa4all-client), [Oviva Epa4all-Rest-Service](https://junglewise.ai/threats/technologies/epa4all-rest-service). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Oviva](https://junglewise.ai/threats/vendors/oviva).

## Quick answers

**Is CVE-2026-45575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45575 being exploited in the wild.

**How severe is CVE-2026-45575?** High severity, with a CVSS score of 7.4, published 26 May 2026.

**Which products and versions are affected?** com.oviva.telematik:epa4all-client (Maven) < 1.2.2, ECOSYSTEM:introduced=0,fixed=1.2.2; Oviva Epa4all-Rest-Service < 1.2.2.

**Is there a fix for CVE-2026-45575?** Yes. com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45575 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45575?** Check whether you run com.oviva.telematik:epa4all-client (Maven) or Oviva Epa4all-Rest-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later

  ```sh
  # set com.oviva.telematik:epa4all-client to 1.2.2 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability in epa4all-client prior to version 1.2.2 stems from improper verification of cryptographic signatures and TLS certificates when fetching the Identity Provider (IDP) discovery document. An attacker capable of performing a Man-in-the-Middle (MITM) attack on the TLS connection between the client and the IDP can substitute a forged discovery document. This forged document redirects the encryption and signature public key URIs (uri_puk_idp_enc and uri_puk_idp_sig) to attacker-controlled endpoints. Consequently, the client encrypts the SMC-B-signed challenge response using the attacker's key and transmits it to the attacker's endpoint, resulting in the theft of signed authentication material. The issue is resolved in version 1.2.2 by enabling default TLS certificate validation and signature verification for discovery documents.

## Affected products

- oviva-ag epa4all-client < 1.2.2
- oviva-ag epa4all-rest-service < 1.2.2

## Identifiers

- CVE-2026-45575
- GHSA-gqx7-6552-67hf

## Timeline

- 2026-05-08: patched: Fix merged in pull request 36
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD dataset

## References

- [https://github.com/oviva-ag/epa4all-client/pull/36](https://github.com/oviva-ag/epa4all-client/pull/36)
- [https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf](https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf)

## Related threats

- [Oviva epa4all-client improper TLS certificate validation](https://junglewise.ai/threats/cve-2026-45574-oviva-epa4all-client-improper-tls-certificate-validation)
- [Oviva epa4all-client signature bypass in SignedPublicKeysTrustValidator](https://junglewise.ai/threats/cve-2026-44900-oviva-epa4all-client-signature-bypass-in)
- [Oviva epa4all-client missing authentication for patient record writes](https://junglewise.ai/threats/cve-2026-47672-oviva-epa4all-client-missing-authentication-for-patient-record)