CVE-2026-45574
High
Description
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic. This includes patient identifiers (KVNR), SMC-B card operations (authentication, signing), document content, and credential exchanges. This vulnerability is fixed in 1.2.2.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCom.oviva.telematik:epa4all-client
PublishedMay 26, 2026
First seenMay 26, 2026
Weakness typeCWE-295CWE-295
How to fix
Update
- com.oviva.telematik:epa4all-client1.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.oviva.telematik:epa4all-clientMaven | v < 1.2.2 | 1.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.