CVE-2026-50577

Received Received - Intake

ePA 3.x Integration AES-GCM Nonce Reuse Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-50577

EUVD

EUVD-2026-61057

Affected Vendors & Products

Vendor	Product	Version / Range
fbeta	epa3-service-opensource	to 1.3.0 (exc)
fbeta	epa3-service-opensource	1.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-323	Nonces should be used for the present occasion and only once.

Attack-Flow Graph

Executive Summary

This vulnerability involves the ePA 3.x Integration software, which handles Germany's electronic patient record. Prior to version 1.3.0, the software fails to increment a request counter when constructing encrypted messages. This causes the server to reuse AES-GCM nonce and key combinations across responses. An attacker can exploit this by collecting ciphertexts to recover plaintext fragments, including sensitive patient data, using predictable HTTP headers and JSON fields. The flaw also enables the Joux forbidden attack to recover the GHASH authentication key, allowing forged messages and malicious response injection.

Detection Guidance

Detecting this vulnerability requires monitoring for repeated AES-GCM nonce reuse in VAU message headers. Check for duplicate request_counter values in VAUProtokoll.py logs or network traffic. Use Wireshark to filter for VAU messages and inspect HTTP headers for repeated counter fields. Monitor for failed response counter validations in server logs.

Impact Analysis

An attacker can intercept encrypted communications to recover sensitive patient health records, authorization details, and medication data. They may also manipulate responses to inject malicious content or alter data. The vulnerability allows unauthorized access to confidential information and potential data tampering, posing significant risks to patient privacy and system integrity.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting patient data confidentiality and integrity. GDPR mandates strict safeguards for health data, while HIPAA requires encryption and access controls. The exposure of patient records and potential data manipulation could result in regulatory penalties, legal liabilities, and loss of trust in the system.

Mitigation Strategies

Immediately update to ePA 3.x Integration version 1.3.0 or higher. Limit session lengths to under 10,000 messages to reduce collision risks. Implement strict monotonic counter validation for both request and response counters. Monitor for anomalous nonce reuse patterns in network traffic.

Hi! I’m here to help you understand CVE-2026-50577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70