epa4all-client CVE-2026-44900

This vulnerability affects the Virtual Access Use-case (VAU) cryptographic trust validation in epa4all-client, a Java library (maven package com.oviva.telematik:epa4all-client) used in German healthcare telematic infrastructure. The flaw resides in the ECDSA signature verification logic within SignedPublicKeysTrustValidatorImpl. While the code correctly configures the Signature object, initializes it with the public key, and calls verify(), it discards the boolean result. The method performs certificate chain validation, OCSP revocation checks, and signature algorithm setup, then unconditionally returns true regardless of whether the cryptographic signature matches. This is a CWE-295 (Improper Certificate Validation) implementation error where security-critical return values are ignored. The vulnerable code path handles signed public keys used to establish trust with VAU endpoints. The patch in PR #34 corrects line 42 from 'ecdsa.verify(signatureDer);' to 'return ecdsa.verify(signatureDer);' and removes the unconditional 'return true' at line 53, ensuring the actual cryptographic verification result controls trust decisions.