GHSA-gqx7-6552-67hfHighCVSS 7.4

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

Published
May 15, 2026
Last Modified
May 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-45575 →

📋 Description

Impact

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged document redirects u ri_puk_idp_enc and uri_puk_idp_sig to attacker-controlled URLs. The client then encrypts the SMC-B-signed challenge response to the attacker's encryption key and POSTs it to the attacker's auth endpoint. This captures the signed authentication material.

Patches

#36

Workarounds

None.

Resources

  • MS-OVIVA-EPA4ALL-d453c1

Credits

Machine Spirits (contact@machinespirits.de)

  • Dr. rer. nat. Simon Weber
  • Dipl.-Inf. Volker Schönefeld
  • Chiara Fliegner

🎯 Affected products1

  • maven/com.oviva.telematik:epa4all-client:< 1.2.2

🔗 References (5)