PT-2026-41396 · Maven+3 · Com.Oviva.Telematik:Epa4All-Client+1

Chiara Fliegner + 2 · Published 2026-05-15 · Updated 2026-05-26 · CVE-2026-45575

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions epa4all-client versions prior to 1.2.2

Description An attacker capable of performing a Man-in-the-Middle (MITM) attack on the TLS connection between the client and the Identity Provider (IDP) within the Telematik Infrastruktur network can substitute a forged discovery document. This document redirects the uri puk idp enc and uri puk idp sig variables to URLs controlled by the attacker. Consequently, the client encrypts the SMC-B-signed challenge response using the attacker's encryption key and sends it via a POST request to the attacker's authentication endpoint, allowing the capture of signed authentication material.

Recommendations Update to version 1.2.2.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-45575

GHSA-GQX7-6552-67HF

Affected Products

Com.Oviva.Telematik:Epa4All-Client

Epa4All-Client

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45575.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45575 · Security Note
• https://osv.dev/vulnerability/GHSA-gqx7-6552-67hf · Vendor Advisory
• https://github.com/oviva-ag/epa4all-client/releases/tag/v1.2.2 · Note
• https://github.com/oviva-ag/epa4all-client/pull/36 · Note
• https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-gqx7-6552-67hf · Note
• https://github.com/oviva-ag/epa4all-client · Note
• https://github.com/oviva-ag/epa4all-client/commit/9111d6fbb939007036a7f74b2a93bb278cb5af32 · Note
• https://reddit.com/r/VulnMatter/comments/1tgqoye/resumen_diario_de_vulnerabilidades_18052026 · Reddit Post