Threats affecting pkg:maven/oviva-ag/epa4all-client

CVE-2026-44900 is a high-severity vulnerability in oviva-ag's epa4all-client Java client prior to version 1.2.1. The vulnerability arises because the method SignedPublicKeysTrustValidatorImpl.isTrusted() fails to verify the result of the ECDSA signature check, effectively trusting any structurally valid signature. Although the method performs certificate chain validation and OCSP checks, it does not confirm that the signature actually matches, leading to improper certificate validation. This flaw could allow an attacker to bypass signature verification, impacting confidentiality and integrity. The issue is fixed in version 1.2.1.

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.

CVE-2026-45575 is a high-severity vulnerability in the oviva-ag epa4all-client Java client used in the Telematik Infrastruktur. Versions prior to 1.2.2 are affected by improper verification of cryptographic signatures (CWE-347). An attacker capable of performing a man-in-the-middle (MITM) attack on the TLS connection within the TI network can substitute a forged discovery document. This document redirects critical URIs to attacker-controlled endpoints, enabling capture of signed authentication material. The vulnerability is fixed in version 1.2.2.