CVE-2026-48021

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48021

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48021.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48021

Aliases

GHSA-vvh7-x6c7-46gh

Published

2026-07-24T18:26:57.751Z

Modified

2026-07-26T03:40:51.821614Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

epa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau

Details

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48021.json",
    "cwe_ids": [
        "CWE-295",
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/med-united/epa4all

Affected ranges

Type

GIT

Repo

https://github.com/med-united/epa4all

Events

Introduced

Fixed

c5cd8741c2153115708b06ab964da55d592b1479

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026-05-20"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

2026-05-18

cida-jan-28

v0.*

v0.1-stable-dec-19

v0.2-stable-dec-27

v0.3-stable-it-dec-28

v0.4-stable-retry-jan-06

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48021.json"

vanir_signatures_modified

"2026-07-26T03:40:51Z"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "98039244948410109368797695824636726789",
                "140430016297131002700873416550302250670",
                "167834253515198390787070888987505958385",
                "113046130139622984861190766185042491132",
                "133400668063268132445289874291126359744",
                "278336862129081460919977635356724472383",
                "286484714550703793110156747917919074900",
                "180184979806288923157701330030523556828",
                "307916128198033797683198464555681838415",
                "264159926835879591099116624755170338081",
                "251902926175393595766281765927889104957"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48021-0127da9c",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/med-united/epa4all/commit/c5cd8741c2153115708b06ab964da55d592b1479",
        "signature_type": "Line",
        "target": {
            "file": "common/src/main/java/de/servicehealth/setup/SystemPropertyService.java"
        }
    },
    {
        "digest": {
            "function_hash": "286477233242537118107103291094725407201",
            "length": 564.0
        },
        "id": "CVE-2026-48021-7101d4b4",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/med-united/epa4all/commit/c5cd8741c2153115708b06ab964da55d592b1479",
        "signature_type": "Function",
        "target": {
            "function": "onStart",
            "file": "common/src/main/java/de/servicehealth/setup/SystemPropertyService.java"
        }
    }
]