The epa4all-client Java client for ePA 3.0 in the Telematik Infrastruktur has an improper certificate validation vulnerability (CWE-295) in versions prior to 1.2.1. Specifically, in the SignedPublicKeysTrustValidatorImpl.isTrusted() method, the boolean return value of Signature.verify() is discarded, meaning the signature verification step is effectively bypassed. Although the method performs other validation steps such as certificate chain validation and OCSP checks, it does not ensure the signature matches the data. This allows any structurally valid signature to be accepted as trusted. The vulnerability is addressed in version 1.2.1.

This vulnerability allows an attacker to bypass ECDSA signature verification, potentially enabling the acceptance of forged certificates or signatures. This compromises the confidentiality and integrity of communications relying on this validation. The CVSS v3.1 score is 8.1 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There are no known exploits in the wild at this time.

A fix is available in epa4all-client version 1.2.1. Users should upgrade to version 1.2.1 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the updated client version. Patch status beyond this is not explicitly stated in the vendor advisory, so users should verify with official vendor sources for the latest guidance.