CVE-2026-48021 | In epa4all, prior to version 2026-05-20, an attacker who can… | CVSS 9.1 CRITICAL

Description

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.

Metadata

CVE ID: CVE-2026-48021
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-20 17:44 UTC
Published: 2026-07-24 18:26 UTC
Last updated: 2026-07-25 00:57 UTC
Primary CWE: CWE-295
CWE-295: Improper Certificate Validation
Vendor / Product: med-united / epa4all
Sources: cve.org · NVD

Severity & Metrics

9.1 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
med-united	epa4all	—	< 2026-05-20

Weakness (CWE)

CWE	Source	Description
CWE-295	cna	CWE-295: Improper Certificate Validation
CWE-347	cna	CWE-347: Improper Verification of Cryptographic Signature

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.1	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References (3)

https://github.com/med-united/epa4all/security/advisories/GHSA-vvh7-x6c7-46gh https://github.com/med-united/epa4all/security/advisories/GHSA-vvh7-x6c7-46gh
https://github.com/med-united/epa4all/releases/tag/2026-05-20 https://github.com/med-united/epa4all/releases/tag/2026-05-20
https://www.machinespirits.com/advisory/aa49f0 https://www.machinespirits.com/advisory/aa49f0