CVE-2026-54342
TLS Certificate Verification Disabled on CXF Transport Clients in epa4all
- State
- Published
- Severity
- 8.1 High
- Published
- Jul 24, 2026
- Updated
- Jul 27, 2026
- Reserved
- Jun 12, 2026
Description
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
epa4allmed-united |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.