CVE-2026-45574CWE-295

epa4all-client: TLS Certificate Validation Disabled in Production

High · published May 26, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-05-26T21:03Z
EPSS history
Timeline
  • 26 MAY 21:03Z
    epa4all-client: TLS Certificate Validation Disabled in Production
    cvelistv5