https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T03:20:07.528302+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-321919 EUVD-2026-321919 2026-10-09T03:20:07.531184+00:00 EUVD-2026-321919 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45574 fkie_cve-2026-45574 2026-10-09T03:20:07.531274+00:00

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.

 https://cve.radiocsirt.org/vuln/ghsa-5hhf-xmfx-4vvr GHSA-5hhf-xmfx-4vvr — epa4all-client: TLS Certificate Validation Disabled in Production 2026-10-09T03:20:07.531352+00:00

Affected: Maven: com.oviva.telematik:epa4all-client

### Impact An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges.

### Patches [#36](https://github.com/oviva-ag/epa4all-client/pull/36)

### Workarounds Use the library directly instead of the REST wrapper.

### Resources - MS-OVIVA-EPA4ALL-771a78

### Credits [Machine Spirits](https://machinespirits.com/) ([contact@machinespirits.de](mailto:contact@machinespirits.de))

- Dr. rer. nat. Simon Weber - Dipl.-Inf. Volker Schönefeld - Chiara Fliegner