CVE-2026-33874CWE-78

Authenticator vulnerable to Remote Code Execution

High · published March 27, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version 4.16.0, the Mac OS version of the Authenticator is vulnerable to remote code execution, triggered when victims open a malicious file. Update the gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-27T20:23Z
EPSS history
Timeline
  • 27 MAR 20:23Z
    Authenticator vulnerable to Remote Code Execution
    cvelistv5