CVE-2026-33875
Received Received - Intake
Authentication Flow Hijacking in Gematik Authenticator Before

Publication date: 2026-03-27

Last updated on: 2026-04-03

Assigner: GitHub, Inc.

Description
Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-27
Last Modified
2026-04-03
Generated
2026-05-07
AI Q&A
2026-03-27
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gematik authenticator to 4.16.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-940 The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-33875 is a critical vulnerability in the gematik app-Authenticator affecting versions 4.15.2 and earlier. It is an authentication flow hijacking issue that allows attackers to impersonate victim users by exploiting malicious deep links.

When a victim clicks on a malicious deep link, the attacker can authenticate as that user without needing any privileges. This happens because the app fails to properly verify that incoming authentication requests come from a trusted source, leading to hijacking of the authentication process remotely over the network.

The vulnerability requires user interaction (clicking the link) but has low attack complexity and no privileges required. It impacts confidentiality and integrity but does not affect availability.


How can this vulnerability impact me? :

This vulnerability can allow attackers to authenticate as you by hijacking your authentication flow if you click on a malicious deep link.

As a result, attackers can gain unauthorized access to your digital health applications using your identity, potentially accessing or modifying sensitive personal health information.

This can lead to serious privacy breaches and misuse of your health data without your consent.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability affects gematik Authenticator versions 4.15.2 and earlier. Detection involves verifying the version of the gematik Authenticator installed on your system or devices.

Since the vulnerability is exploited via malicious deep links that hijack the authentication flow, monitoring for suspicious deep link clicks or unexpected authentication requests originating from untrusted sources could help detect exploitation attempts.

There are no specific network or system commands provided to detect this vulnerability directly.

To check the version of the gematik Authenticator app, you can verify it within the app interface or use platform-specific commands to list installed app versions, for example:

  • On Android devices, use: adb shell dumpsys package de.gematik.appauthenticator | grep versionName
  • On iOS devices, check the app version in the Settings app under the gematik Authenticator entry.

What immediate steps should I take to mitigate this vulnerability?

The only effective mitigation for this vulnerability is to update the gematik Authenticator app to version 4.16.0 or later, where the issue has been fixed.

There are no known workarounds or alternative mitigations available.

Users should update the app via official app stores or GitHub releases and verify the installed version to ensure the patch is applied.

Additionally, users should be cautious about clicking on deep links from untrusted or unknown sources to reduce the risk of exploitation.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability allows attackers to hijack the authentication flow and impersonate victim users, potentially leading to unauthorized access to sensitive personal health information.

Such unauthorized access and identity impersonation could result in violations of data protection regulations like GDPR and HIPAA, which mandate strict controls on user authentication and protection of personal health data.

However, the provided information does not explicitly discuss compliance impacts or regulatory consequences.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart