https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T03:23:47.368912+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45574 CVE-2026-45574 — epa4all-client: TLS Certificate Validation Disabled in Production 2026-10-09T03:23:47.385419+00:00

Affected: oviva-ag epa4all-client, com.oviva.telematik epa4all-client

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.