PT-2026-41396 · Maven · Com.Oviva.Telematik:Epa4All-Client

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-45575

OSV

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Impact

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri puk idp enc and uri puk idp sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material.

Patches

#36

Workarounds

None.

Resources

• MS-OVIVA-EPA4ALL-d453c1

Credits

Machine Spirits ([e-mail])

• Dr. rer. nat. Simon Weber
• Dipl.-Inf. Volker Schönefeld
• Chiara Fliegner

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-45575

GHSA-GQX7-6552-67HF

Affected Products

Com.Oviva.Telematik:Epa4All-Client

References · 6

• https://osv.dev/vulnerability/GHSA-gqx7-6552-67hf · Vendor Advisory
• https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf · Note
• https://github.com/oviva-ag/epa4all-client/pull/36 · Note
• https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2 · Note
• https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32 · Note
• https://github.com/oviva-ag/epa4all-client · Note