EUVD-2026-61057Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attacker must achieve network interception to collect ciphertexts (AC:H, AV:N); no authentication required (PR:N); full plaintext recovery and forgery justify C:H and I:H; no availability disruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.
AnalysisAI
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen request_counter in VAUProtokoll.py causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a network interception position allowing the attacker to observe multiple VAU-encrypted messages between an ePA 3.x Integration client and the ePA backend during an active session - achievable via passive monitoring on a shared network segment, a compromised intermediary device, or a man-in-the-middle position on the clinical network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.4 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is well-calibrated: AC:H correctly reflects that exploitation requires a network interception position enabling collection of multiple ciphertexts, which is non-trivial but achievable on shared or compromised network segments in healthcare infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 1.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running ePA3-Service-OpenSource and document currently deployed versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Epa3 Service Opensource
View allTLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path att
TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposi
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitr
Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today