ePA 3.x Integration VAU Server Certificate Validation Bypass

Executive Summary

CVE-2026-52723 is a critical authentication bypass vulnerability in the ePA 3.x Integration software. It allows a network-positioned attacker to intercept the VAU handshake between a DiGA backend and the ePA system. The attacker can supply fake certificate and key material, bypassing server authentication due to improper certificate validation and disabled TLS verification. This enables the attacker to impersonate the VAU server, control session keys, and decrypt or modify all encrypted VAU traffic.

The flaw stems from a circular trust relationship where the server's certificate is validated against itself without anchoring to trusted material. Affected versions before 1.3.0 fail to properly validate certificate chains or enforce required checks like OCSP revocation or temporal validity.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of ePA 3.x Integration. Run commands like 'pip show ePA3-Service-OpenSource' or inspect version files in the deployment directory. If the version is below 1.3.0, the system is vulnerable. Monitor network traffic for unexpected certificate exchanges or TLS handshake anomalies between DiGA backend and ePA systems.

Useful 0 Not Useful 0

Impact Analysis

If you use ePA 3.x Integration versions prior to 1.3.0, an attacker could intercept, read, or alter all medical data transmitted between your DiGA backend and the ePA system. This includes sensitive patient information protected under medical confidentiality laws. The attacker gains full control over the encrypted communication channel without needing credentials or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability severely impacts compliance with GDPR and HIPAA by enabling unauthorized access to and modification of protected health information. GDPR requires appropriate technical measures to ensure confidentiality and integrity of personal data, which this flaw directly violates. HIPAA mandates secure transmission of health data, which is compromised here. Organizations using affected versions risk regulatory penalties and loss of patient trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to version 1.3.0 or later of ePA 3.x Integration. Ensure TI-PKI-Root certificates are correctly loaded into the truststore. Verify that all certificate validation checks (including OCSP revocation, time validity, and role OIDs) are enabled. Disable any disabled TLS certificate verification settings.

Useful 0 Not Useful 0