CVE-2026-54342 describes an improper certificate validation vulnerability (CWE-295) in the epa4all product by med-united. Before version 2026-05-20, epa4all does not properly verify TLS certificates when communicating with backend systems such as ePA Aktensystem, Konnektor, IDP, and TSS. An attacker positioned on the network path can present a self-signed TLS certificate, causing the client to accept it and enabling interception and modification of the traffic. For non-VAU connections (Konnektor, IDP), this allows direct reading and tampering of inner traffic including smartcard operations and OIDC authentication exchanges. For the ePA backend, this vulnerability facilitates a man-in-the-middle attack at the transport layer that enables further attacks described in GHSA-vvh7-x6c7-46gh. The vulnerability is patched in version 2026-05-20.

The vulnerability allows an attacker with network access to intercept and modify sensitive communications between epa4all and its backend services. This includes the ability to read and alter smartcard operations and authentication exchanges, potentially compromising user credentials and session integrity. The issue does not affect availability but has high confidentiality and integrity impact.

A fix is available in epa4all version 2026-05-20. Users should upgrade to this version or later to ensure proper TLS certificate validation and prevent man-in-the-middle attacks. No other mitigation guidance is provided or required.