The gematik app-Authenticator before version 4.16.0 suffers from CWE-940, improper verification of the source of a communication channel. This flaw allows an attacker to hijack the authentication flow by leveraging malicious deep links clicked by victim users. Successful exploitation can result in the attacker authenticating as the victim, compromising user identity and access to digital health applications. The vulnerability is rated critical with a CVSS 3.1 score of 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. The vendor has released version 4.16.0 to address this issue.

Exploitation of this vulnerability allows attackers to impersonate victim users by hijacking the authentication flow, leading to unauthorized access to digital health applications. This compromises user confidentiality and integrity of authentication processes. There is no impact on availability reported. No known exploits are currently in the wild.

Update the gematik app-Authenticator to version 4.16.0 or later to apply the official fix. There are no known workarounds. Users should ensure they do not click on suspicious deep links until the update is applied.