epa4all-client CVE-2026-45575
HIGH
GHSA-gqx7-6552-67hf
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 maven packages depend on com.oviva.telematik:epa4all-client (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.2.2.
DescriptionNVD
Impact
An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material.
Patches
Workarounds
None.
Resources
- MS-OVIVA-EPA4ALL-d453c1
Credits
Machine Spirits ([contact@machinespirits.de](mailto:contact@machinespirits.de))
- Dr. rer. nat. Simon Weber
- Dipl.-Inf. Volker Schönefeld
- Chiara Fliegner
AnalysisAI
Authentication bypass in epa4all-client allows MITM attackers positioned within the TI (Telematikinfrastruktur) network to capture SMC-B-signed authentication material by substituting a forged OIDC discovery document. The vulnerability affects all versions prior to 1.2.2 and requires the attacker to intercept TLS connections between the client and Identity Provider. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all instances of epa4all-client across healthcare IT environments and document current versions. Within 7 days: Apply vendor patch to epa4all-client version 1.2.2 or later on all systems; prioritize systems handling sensitive healthcare data. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today