EUVD-2026-61054Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network vector confirmed; AC:H because attacker must control a specific interpolated header value; PR:L for required authenticated session; C:H and I:H for cross-patient PHI exposure and auth bypass; A:N as no denial-of-service impact is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
AnalysisAI
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at least low-privilege access to the ePA3-Service-OpenSource endpoints (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 6.8 - medium - but the confidentiality and integrity impacts are both rated High, reflecting the sensitivity of the data at stake: protected health information under German law. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade to ePA3-Service-OpenSource version 1.3.0, which introduces sanitize_header_value() and validate_insurant_id() across all header construction sites in VAUProtokoll.py and client.py. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Epa3 Service Opensource
View allTLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path att
TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposi
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to rec
Same weakness CWE-113 – HTTP Response Splitting
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today