CVE-2026-54342 Details

A vulnerability in ePA4all prior to version 2026-05-20 allows an attacker on the network path to intercept connections by presenting a self-signed TLS certificate. This issue arises from disabled TLS verification, which is applied to all CXF transport clients and affects non-VAU connections with the Konnektor and IDP. The vulnerability enables direct reading and modification of inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the lack of proper TLS verification facilitates a VAU man-in-the-middle attack, as detailed in a related advisory.

Users should update to ePA4all version 2026-05-20 or later, which restores proper TLS verification by adding hostname and certificate checks, and pins the gematik TI PKI via a Telematik-TSL-based keystore. After updating, verify that the trust store includes the TI PKI roots and that no permissive hostname verifiers are present.