CVE-2026-50578

{
  "id": "CVE-2026-50578",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T17:16:58.933",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."
    },
    {
      "lang": "es",
      "value": "La Integración de ePA 3.x implementa el flujo de trabajo de autorización y escribe Objetos de Información Médica en el registro electrónico de pacientes de Alemania. Antes de la versión 1.3.0, la Integración de ePA 3.x deshabilita la verificación de certificados TLS tanto para las conexiones ePA en app/vau/VAUProtokoll.py como para las conexiones Konnektor en app/konnektor/Konnektor.py. Un atacante posicionado en la red puede presentar un certificado arbitrario, terminar la conexión TLS e interceptar el tráfico ePA. El protocolo VAU no proporciona una alternativa efectiva porque su validación de certificados a nivel de aplicación también está rota en las versiones afectadas. La sesión Konnektor utiliza self.session.verify establecido en False mientras el cliente se autentica con self.session.cert, por lo que un atacante que suplante al Konnektor puede recibir el intercambio de certificados TLS mutuo del cliente y observar las operaciones de la tarjeta inteligente. Este problema está solucionado en la versión 1.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "fbeta-GmbH",
          "product": "ePA3-Service-OpenSource",
          "versions": [
            {
              "version": "< 1.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T17:44:33.357494Z",
          "id": "CVE-2026-50578",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr",
      "source": "[email protected]"
    },
    {
      "url": "https://www.machinespirits.de/advisory/4b68b0",
      "source": "[email protected]"
    }
  ]
}