epa4all-client CVE-2026-45575

Successful exploitation requires the attacker to achieve a man-in-the-middle position specifically within the TI (Telematikinfrastruktur) network between the client and the IDP. This is a significant constraint as the TI network is a closed healthcare infrastructure with controlled access points. The attack does not require authentication or user interaction once network position is achieved. Standard TLS protections outside the TI network context would prevent this attack, highlighting the specialized nature of the vulnerability.

This vulnerability presents moderate real-world risk despite the high CVSS score of 7.4. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates remote unauthenticated exploitation is possible but with high attack complexity. The primary limiting factor is the requirement for MITM positioning within the TI network infrastructure, which significantly constrains the attacker pool. No EPSS score or CISA KEV listing indicates this is not being actively exploited. The impact is severe if executed successfully - compromise of healthcare authentication credentials - but the specialized attack requirements and targeted nature suggest this affects compliance more than immediate operational risk for most deployments.

An attacker with network access within the TI infrastructure intercepts TLS traffic between the epa4all-client and the Identity Provider. They inject a malicious OIDC discovery document that redirects cryptographic endpoints to attacker-controlled servers. When the client performs authentication, it encrypts the SMC-B-signed challenge response using the attacker's public key and sends it to the attacker's endpoint, exposing the authentication material.