CVE-2026-45574

epa4all-client: TLS Certificate Validation Disabled in Production

CVSS 8.1 HIGHEPSS 0.1%CWE-295

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 May 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

com.oviva.telematik · epa4all-client oviva-ag · epa4all-client

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/oviva-ag/epa4all-client/pull/36 https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr