CVE-2026-48021 Details

A vulnerability in epa4all prior to version 2026-05-20 allows an attacker to intercept the TLS connection between epa4all and the ePA backend. This interception enables the attacker to complete the VAU handshake using their own keys, thereby obtaining session encryption keys. As a result, all inner HTTP traffic, including patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries, becomes readable and modifiable. Additionally, the attacker can inject arbitrary requests through the compromised channel.

Users should update to version 2026-05-20 or later, ensuring that the TI PKI root certificates are properly loaded at runtime. After updating, verify that the VAU server authentication is functioning correctly by testing with a self-signed certificate that mimics an attacker's keys.