PT-2026-28546 · Unknown · Gematik Authenticator

Dr. Simon Weber + 1 · Published 2026-03-27 · Updated 2026-03-29 · CVE-2026-33875

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gematik Authenticator versions prior to 4.16.0

Description Gematik Authenticator is used to securely authenticate users for login to digital health applications. Versions prior to 4.16.0 are susceptible to authentication flow hijacking. An attacker could potentially authenticate as a victim user if the user clicks on a malicious deep link.

Recommendations Update Gematik Authenticator to version 4.16.0 or greater.

Exploit

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-33875

GHSA-QG87-CF56-2RMR

Affected Products

Gematik Authenticator

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33875.json · Exploit
• https://github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33875 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33875 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2037630570625106166 · Twitter Post
• https://machinespirits.com/advisory/f41e56 · Note
• https://twitter.com/CVEnew/status/2037719398266618243 · Twitter Post
• https://twitter.com/CosmicBytez/status/2038115365247697023 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037650842552250767 · Twitter Post
• https://twitter.com/CveFindCom/status/2037646546984951914 · Twitter Post