EUVD-2026-61056Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MitM network positioning is a prerequisite, warranting AC:H over the vendor-assigned AC:L; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
AnalysisAI
TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposing all traffic between the integration service and Germany's electronic patient record system and Konnektor devices to interception by network-positioned attackers. Both the primary TLS layer - via hardcoded verify=False in Python requests sessions across two independent modules - and the VAU protocol's application-layer certificate validation are broken simultaneously, eliminating all cryptographic trust anchors with no defense-in-depth fallback. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must achieve a man-in-the-middle network position on the path between the ePA integration service and either the ePA server or the Konnektor device - for example via ARP spoofing, rogue gateway, or compromise of an intermediate routing node on the same LAN segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector (score 7.5) correctly captures the high confidentiality impact and absence of authentication requirements, but the AC:L rating arguably overstates ease of exploitation given that a successful attack requires network-positioning between the ePA integration service and the Konnektor or ePA server - a condition that strict CVSS practice typically encodes as AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ePA3-Service-OpenSource version 1.3.0 immediately; this is the vendor-released patch and the only confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Implement immediate network segmentation to isolate all ePA3-Service-OpenSource systems from untrusted networks and restrict traffic to approved internal healthcare operations networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Epa3 Service Opensource
View allTLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path att
AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to rec
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitr
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today