VAU Server Authentication Bypass in epa4all (GHSA-vvh7-x6c7-46gh/CVE-2026-48021)

VAU Server Authentication Bypass via Missing A_24624-01 Verification in epa4all Vulnerability Overview Vulnerability Name: VAU Server Authentication Bypass via Missing A_24624-01 Verification in epa4all Vulnerability ID: GHSA-vvh7-x6c7-46gh Publication Date: 2026-05-20 Severity: Critical (9.1 / 10) CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None CVE ID: CVE-2026-48021 CWE: CWE-347 Impact Scope Affected Versions: 1.0.0-SNAPSHOT Fixed Version: 2026-05-20 Impact Description: - An attacker can intercept the TLS connection and complete the VAU handshake between epa4all and the ePA backend, obtaining session encryption keys using attacker-controlled keys. - All internal HTTP traffic (patient consent decisions, medical data, document operations, authorization tokens, and credential queries) becomes readable and modifiable. - The attacker can also inject arbitrary requests through the hijacked channel. Vulnerability Details VAU Protocol Client: - Implemented using gematik's reference , without adding server authentication checks. - During the VAU handshake, the client receives Message 2, which contains the server's (ECDH and Kyber768 public keys), signed by an ES256 key bound to the TI PKI certificate. - The , , and fields are deserialized from CBOR but are never read by any validation code path. - Specifically, epa4all fails to verify: - The ES256 signature on the signing public key - The certificate chain to the TI PKI root - The OCSP revocation status - The role OID ( ) - The bundled performs key format validation and key expiration checks (two A_24624-01 steps) but does not authenticate the server. Attack Vector 1. The attacker is located on the network path between epa4all and the ePA backend (e.g., in a local Docker deployment model within a clinical LAN). 2. The attacker intercepts VAU Message 1, which contains the client's ECDH and Kyber768 public keys. 3. The attacker generates their own ECDH + Kyber768 key pair, creates a self-signed X.509 certificate, and signs the VAU public key using E. 4. The attacker constructs Message 2 and sends it to the client. 5. The client calls to retrieve the certificate. The attacker provides the self-signed certificate. The , , and fields are deserialized in but are never read by any code path. 6. The client derives the K2 session key using the attacker's public key. The attacker holds the corresponding private key and derives the same K2 key. 7. All subsequent internal HTTP traffic is readable, modifiable, and injectable by the attacker. Remediation Patch: The issue was fixed in version . Workaround: No workaround available. References Machine Spirits Advisory: https://www.machinespirits.com/advisory/epa4all Related: GHSA-29gw-x8c3-3477 (TLS Certificate Verification Disabled)

Goal Reached Thanks to every supporter — we hit 100%!

VAU Server Authentication Bypass in epa4all (GHSA-vvh7-x6c7-46gh/CVE-2026-48021)

More from this source