Executive brief
epa4all is a software component used to connect medical practices to the German electronic patient record (ePA) system. A security flaw allows an attacker positioned on the network to impersonate the official ePA backend and intercept sensitive communications. This could lead to the exposure or modification of patient medication data, consent decisions, and medical documents, potentially compromising patient privacy and the integrity of medical records.
Technical details
The VAU protocol client in epa4all integrates gematik's reference lib-vau implementation but fails to implement the server authentication checks required by gemSpec_Krypt A_24624-01. Specifically, the client deserializes but does not verify the ES256 signature, certificate chain, or OCSP status of the server's signed public keys in VAU Message 2. An attacker capable of intercepting the TLS connection can perform a Man-in-the-Middle (MitM) attack by providing their own public keys and a self-signed certificate. This allows the attacker to derive the session encryption keys (K2), granting full plaintext access to inner HTTP traffic including patient consent decisions and medication data. The issue is fixed in version 2026-05-20.
Affected products
- med-united epa4all < 2026-05-20
Timeline
- 2026-05-20: patched: Fix released in version 2026-05-20
- 2026-05-20: disclosed
- 2026-07-24: advisory: NVD publication date