What is the CVSS score of CVE-2026-45575?

CVE-2026-45575 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of epa4all-client are affected by CVE-2026-45575?

CVE-2026-45575 is an authentication bypass in epa4all-client that allows network-positioned attackers to intercept and forge OIDC authentication tokens, potentially compromising access to sensitive…. A patch is available.

How to fix or mitigate CVE-2026-45575?

Within 24 hours: Inventory all instances of epa4all-client across healthcare IT environments and document current versions. Within 7 days: Apply vendor patch to epa4all-client version 1.2.2 or later on all systems; prioritize systems handling sensitive healthcare data. Within 30 days: Conduct post-patch verification testing and review TLS/MITM detection capabilities within the TI network infrastructure.

epa4all-client CVE-2026-45575

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-15 https://github.com/oviva-ag/epa4all-client

GHSA-gqx7-6552-67hf

Jwt Attack Information Disclosure

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 15, 2026 - 19:31 vuln.today

Analysis Generated

May 15, 2026 - 19:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on com.oviva.telematik:epa4all-client (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.2.2.

DescriptionGitHub Advisory

Impact

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material.

Patches

#36

Workarounds

None.

Resources

MS-OVIVA-EPA4ALL-d453c1

Credits

Machine Spirits ([contact@machinespirits.de](mailto:contact@machinespirits.de))

Dr. rer. nat. Simon Weber
Dipl.-Inf. Volker Schönefeld
Chiara Fliegner

AnalysisAI

Authentication bypass in epa4all-client allows MITM attackers positioned within the TI (Telematikinfrastruktur) network to capture SMC-B-signed authentication material by substituting a forged OIDC discovery document. The vulnerability affects all versions prior to 1.2.2 and requires the attacker to intercept TLS connections between the client and Identity Provider. No public exploit identified at time of analysis.

Technical ContextAI

The epa4all-client is a Java library (Maven package com.oviva.telematik:epa4all-client) used in Germany's healthcare telematics infrastructure for electronic patient records (ePA). The vulnerability stems from improper verification of cryptographic signatures (CWE-347) in OIDC discovery documents. During authentication, the client fetches a discovery document that specifies encryption and signature verification endpoints. Without proper validation of the document's authenticity, an attacker can redirect uri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs, causing the client to encrypt sensitive authentication responses using the attacker's public key.

RemediationAI

Vendor-released patch: upgrade to epa4all-client version 1.2.2 or later. The fix is available through standard Maven dependency updates. Technical details of the patch can be reviewed at https://github.com/oviva-ag/epa4all-client/pull/36. The vendor explicitly states no workarounds are available, making immediate patching the only remediation option. Organizations unable to patch immediately should monitor for suspicious authentication patterns and consider enhanced network segmentation within the TI infrastructure to limit potential MITM positions.