CVE-2026-50578
Received Received - Intake

TLS Certificate Verification Bypass in ePA 3.x Integration

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-50578
EUVD
EUVD-2026-61056

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fbeta_gmbh epa3-service-opensource to 1.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the ePA 3.x Integration system before version 1.3.0. It disables TLS certificate verification for both ePA and Konnektor connections, allowing a network attacker to intercept traffic by presenting a fake certificate. The VAU protocol's application-layer validation is also broken, and the Konnektor session improperly handles mutual TLS authentication.

Detection Guidance

Check if your ePA 3.x Integration version is below 1.3.0 by running version inspection commands like 'pip show ePA-3x-Integration' or checking application logs for version details. Inspect app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py for disabled TLS certificate verification settings such as 'verify=False' or 'self.session.verify = False'.

Impact Analysis

An attacker could intercept sensitive medical data transmitted via the ePA system, including patient records and authentication exchanges. This could lead to unauthorized access to medical information or manipulation of data during transmission.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for secure transmission of medical data. It enables unauthorized interception of sensitive health information, which is a direct violation of data protection and privacy regulations.

Mitigation Strategies

Upgrade ePA 3.x Integration to version 1.3.0 or later immediately. Ensure TLS certificate verification is enabled in app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py by removing any code disabling verification. Review network traffic for unauthorized interception attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart