CVE-2026-48021 is a vulnerability in med-united's epa4all software where improper certificate validation (CWE-295) allows an attacker intercepting the TLS connection to complete the VAU handshake using attacker-controlled keys. This results in the attacker obtaining session encryption keys, enabling them to read and modify all inner HTTP traffic such as patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries. Additionally, the attacker can inject arbitrary requests through the hijacked channel. The vulnerability affects versions prior to 2026-05-20 and has been patched in that version.

Successful exploitation allows an unauthenticated network attacker to intercept and decrypt sensitive medical and authorization data transmitted between epa4all and the ePA backend. The attacker can also modify this data and inject arbitrary requests, potentially compromising patient privacy and system integrity. The vulnerability does not impact availability but has high confidentiality and integrity impact.

This vulnerability has been patched in epa4all version 2026-05-20. Users should upgrade to version 2026-05-20 or later to remediate this issue. No other mitigation guidance is provided or necessary as the fix addresses the root cause.