CVE-2026-33875

{
  "id": "CVE-2026-33875",
  "sourceIdentifier": "[email protected]",
  "published": "2026-03-27T21:17:24.377",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds."
    },
    {
      "lang": "es",
      "value": "Gematik Authenticator autentica de forma segura a los usuarios para iniciar sesión en aplicaciones de salud digitales. Las versiones anteriores a la 4.16.0 son vulnerables al secuestro del flujo de autenticación, lo que podría permitir a los atacantes autenticarse con las identidades de usuarios víctimas que hacen clic en un enlace profundo malicioso. Actualice Gematik Authenticator a la versión 4.16.0 o superior para recibir un parche. No se conocen soluciones alternativas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gematik",
          "product": "app-Authenticator",
          "versions": [
            {
              "version": "< 4.16.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-03-30T18:57:25.759977Z",
          "id": "CVE-2026-33875",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-940"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gematik:authenticator:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.16.0",
              "matchCriteriaId": "B6F3F2CC-8AAB-467C-A2CB-D8D994FB4195"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmr",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.machinespirits.com/advisory/f41e56/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}