CVE-2026-54342
TLS Certificate Verification Disabled on CXF Transport Clients in epa4all
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.
| CWE | CWE-295 |
| Vendor | med-united |
| Product | epa4all |
| Published | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for med-united epa4all
Be the first to know when new high vulnerabilities affecting med-united epa4all are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
med-united / epa4all
< 2026-05-20
References
github.com: https://github.com/med-united/epa4all/security/advisories/GHSA-296w-v8f6-3rf7 github.com: https://github.com/med-united/epa4all/security/advisories/GHSA-vvh7-x6c7-46gh github.com: https://github.com/med-united/epa4all/releases/tag/2026-05-20 machinespirits.com: https://www.machinespirits.com/advisory/b98b02