PT-2026-41395 · Maven · Com.Oviva.Telematik:Epa4All-Client

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-45574

OSV

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Impact

An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges.

Patches

#36

Workarounds

Use the library directly instead of the REST wrapper.

Resources

• MS-OVIVA-EPA4ALL-771a78

Credits

Machine Spirits ([e-mail])

• Dr. rer. nat. Simon Weber
• Dipl.-Inf. Volker Schönefeld
• Chiara Fliegner

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-45574

GHSA-5HHF-XMFX-4VVR

Affected Products

Com.Oviva.Telematik:Epa4All-Client

References · 6

• https://osv.dev/vulnerability/GHSA-5hhf-xmfx-4vvr · Vendor Advisory
• https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-5hhf-xmfx-4vvr · Note
• https://github.com/oviva-ag/epa4all-client/pull/36 · Note
• https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2 · Note
• https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32 · Note
• https://github.com/oviva-ag/epa4all-client · Note