med-united epa4all TLS Certificate Verification Disabled (CVE-2026-54342)

The following is a summary of the key vulnerability information from the webpage screenshot: --- Vulnerability Overview Vulnerability Name: TLS Certificate Verification Disabled Product: med-united epa4all Severity Level: CVSS 8.1 (High) CVE: CVE-2026-54342 GHSA: GHSA-296w-v8f6-3rr7 Disclosure Date: 2026-05-20 (Full Disclosure) Authors: Chiara Flegner, Volker Schönefeld, Simon Weber Core Issue: In , an that trusts all certificates is installed. Its and methods are empty, and returns an empty array, resulting in disabled hostname verification and certificate verification. Attackers can perform Man-in-the-Middle (MITM) attacks to intercept and tamper with traffic. --- Scope of Impact Affected Versions: 1.0.0-SNAPSHOT and builds prior to 2026-05-20 (including commit ) Attack Scenarios: - The attacker is located on the network path between and the backend (e.g., ePA Document System, IDP, Konnektor). - Can forge arbitrary certificates to establish TLS connections, relaying or tampering with data. - Intercepted content includes: patient identifiers, document content, IDP credential exchange, and SMC-B card operations. - In the deployment model, runs on the clinic LAN, with access to the gematik infrastructure, posing a very high risk. Additional Risks: - Application-layer validation of the VAU server is missing (see ); even if TLS is fixed, application-layer authentication is required. --- Remediation 1. Update to Secure Versions > Update to builds from 2026-05-20 or later This version restores certificate and hostname verification and uses a keystore based on Telematik-TSL. 2. Confirm Trust Anchors The backend uses TI PKI (GEM.RCA-X) certificates, not the default Mozilla root certificates. A dedicated keystore containing the gematik root CA must be bound, and default hostname checking should be disabled. 3. Verify No Residual Unsafe Configurations Remain Check the following code paths to ensure they no longer exist: Ensure these configurations have been removed from production code. 4. Pair Fix with VAU Server Authentication Bypass The TLS fix only protects the transport layer; the must also be fixed simultaneously to validate the VAU server's signature public key. --- POC / Exploit Code 1. 2. 3. CXF HTTP Transport Layer Configuration ( ) --- Severity Reasoning (CVSS Vector) Attack Vector: Network (A) Attack Complexity: Low (L) Privileges Required: None (N) User Interaction: None (N) Scope: Unchanged (U) Confidentiality Impact: High (H) Integrity Impact: High (H) Availability Impact: None (N) --- References GHSA-296w-v8f6-3rr7 (med-united) med-united epa4all Repository Related: VAU Server Authentication Bypass in epa4all Related: ePA-VAU Client Security overview --- ✅ Immediate upgrade to builds after 2026-05-20 is recommended, paired with the fix for the VAU authentication bypass vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

med-united epa4all TLS Certificate Verification Disabled (CVE-2026-54342)