The epa4all-client, a Java client used in the Telematik Infrastruktur for ePA 3.0, suffers from improper certificate validation (CWE-295) before version 1.2.2. This flaw enables a man-in-the-middle attacker on the network path between the ePA service and the Konnektor to intercept and read all SOAP communications by presenting invalid TLS certificates without detection. The intercepted data includes highly sensitive information such as patient identifiers (KVNR), SMC-B card operations (authentication and signing), document contents, and credential exchanges. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity. The issue is resolved in epa4all-client version 1.2.2.

An attacker positioned on the network path can intercept and decrypt sensitive SOAP traffic due to acceptance of any TLS certificate by vulnerable epa4all-client versions. This compromises confidentiality of patient identifiers, authentication credentials, document contents, and signing operations. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Upgrade the epa4all-client to version 1.2.2 or later, where the improper certificate validation vulnerability is fixed. Since this is a client-side vulnerability and not a cloud service, applying this official fix is necessary to prevent interception of sensitive data. Patch status is confirmed by the vendor's versioning information. No alternative mitigations are indicated.