Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities by fbeta-GmbH

    CVE-2026-52723 (GCVE-0-2026-52723)

    Vulnerability from nvd – Published: 2026-08-18 16:50 – Updated: 2026-08-18 17:38
    VLAI
    Title
    ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 17:38 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:38:28.386866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:38:36.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:50:49.799Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-q2jw-6c4w-86jc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-q2jw-6c4w-86jc"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/12"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/197c8c7fc41675f19c7f448696a2bc63fab9db5b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/197c8c7fc41675f19c7f448696a2bc63fab9db5b"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/a1da93",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/a1da93"
        }
      ],
      "source": {
        "advisory": "GHSA-q2jw-6c4w-86jc",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52723",
    "datePublished": "2026-08-18T16:50:49.799Z",
    "dateReserved": "2026-06-08T14:00:43.571Z",
    "dateUpdated": "2026-08-18T17:38:36.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50578 (GCVE-0-2026-50578)

    Vulnerability from nvd – Published: 2026-08-18 16:51 – Updated: 2026-08-18 17:45
    VLAI
    Title
    ePA 3.x Integration: TLS Certificate Verification Universally Disabled
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 17:44 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:44:33.357494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:45:53.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client\u0027s mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:51:45.177Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/4b68b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/4b68b0"
        }
      ],
      "source": {
        "advisory": "GHSA-j9m9-pmwv-hwwr",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: TLS Certificate Verification Universally Disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50578",
    "datePublished": "2026-08-18T16:51:45.177Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-18T17:45:53.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50577 (GCVE-0-2026-50577)

    Vulnerability from nvd – Published: 2026-08-18 16:52 – Updated: 2026-08-19 14:52
    VLAI
    Title
    ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.
    Severity
    7.4 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-19 14:52 UTC
    CWE
    • CWE-323 - Reusing a Nonce, Key Pair in Encryption
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T14:52:41.729661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T14:52:55.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-323",
              "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:52:38.214Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-vmfm-3f7g-r9qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-vmfm-3f7g-r9qg"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/10"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/85c4c516088c38b9cf2343f388ad67a6744e9814",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/85c4c516088c38b9cf2343f388ad67a6744e9814"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/df27cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/df27cd"
        }
      ],
      "source": {
        "advisory": "GHSA-vmfm-3f7g-r9qg",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50577",
    "datePublished": "2026-08-18T16:52:38.214Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-19T14:52:55.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50576 (GCVE-0-2026-50576)

    Vulnerability from nvd – Published: 2026-08-18 16:49 – Updated: 2026-08-18 19:07
    VLAI
    Title
    ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 19:07 UTC
    CWE
    • CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50576",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:07:38.144792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:07:45.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient\u0027s records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:49:43.358Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j8jg-7fqf-4xx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j8jg-7fqf-4xx9"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/11"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/b984d15d261423302de337adae25e84c54e9c2d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/b984d15d261423302de337adae25e84c54e9c2d1"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/013a60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/013a60"
        }
      ],
      "source": {
        "advisory": "GHSA-j8jg-7fqf-4xx9",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50576",
    "datePublished": "2026-08-18T16:49:43.358Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-18T19:07:45.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50577 (GCVE-0-2026-50577)

    Vulnerability from cvelistv5 – Published: 2026-08-18 16:52 – Updated: 2026-08-19 14:52
    VLAI
    Title
    ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.
    Severity
    7.4 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-19 14:52 UTC
    CWE
    • CWE-323 - Reusing a Nonce, Key Pair in Encryption
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T14:52:41.729661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T14:52:55.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-323",
              "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:52:38.214Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-vmfm-3f7g-r9qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-vmfm-3f7g-r9qg"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/10"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/85c4c516088c38b9cf2343f388ad67a6744e9814",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/85c4c516088c38b9cf2343f388ad67a6744e9814"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/df27cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/df27cd"
        }
      ],
      "source": {
        "advisory": "GHSA-vmfm-3f7g-r9qg",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50577",
    "datePublished": "2026-08-18T16:52:38.214Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-19T14:52:55.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50578 (GCVE-0-2026-50578)

    Vulnerability from cvelistv5 – Published: 2026-08-18 16:51 – Updated: 2026-08-18 17:45
    VLAI
    Title
    ePA 3.x Integration: TLS Certificate Verification Universally Disabled
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 17:44 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:44:33.357494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:45:53.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client\u0027s mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:51:45.177Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/4b68b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/4b68b0"
        }
      ],
      "source": {
        "advisory": "GHSA-j9m9-pmwv-hwwr",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: TLS Certificate Verification Universally Disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50578",
    "datePublished": "2026-08-18T16:51:45.177Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-18T17:45:53.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-52723 (GCVE-0-2026-52723)

    Vulnerability from cvelistv5 – Published: 2026-08-18 16:50 – Updated: 2026-08-18 17:38
    VLAI
    Title
    ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 17:38 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T17:38:28.386866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:38:36.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:50:49.799Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-q2jw-6c4w-86jc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-q2jw-6c4w-86jc"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/12"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/197c8c7fc41675f19c7f448696a2bc63fab9db5b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/197c8c7fc41675f19c7f448696a2bc63fab9db5b"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/a1da93",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/a1da93"
        }
      ],
      "source": {
        "advisory": "GHSA-q2jw-6c4w-86jc",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52723",
    "datePublished": "2026-08-18T16:50:49.799Z",
    "dateReserved": "2026-06-08T14:00:43.571Z",
    "dateUpdated": "2026-08-18T17:38:36.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50576 (GCVE-0-2026-50576)

    Vulnerability from cvelistv5 – Published: 2026-08-18 16:49 – Updated: 2026-08-18 19:07
    VLAI
    Title
    ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
    Summary
    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-18 19:07 UTC
    CWE
    • CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50576",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:07:38.144792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:07:45.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ePA3-Service-OpenSource",
          "vendor": "fbeta-GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany\u0027s electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient\u0027s records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T16:49:43.358Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j8jg-7fqf-4xx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j8jg-7fqf-4xx9"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/11"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/b984d15d261423302de337adae25e84c54e9c2d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/b984d15d261423302de337adae25e84c54e9c2d1"
        },
        {
          "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"
        },
        {
          "name": "https://www.machinespirits.de/advisory/013a60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.machinespirits.de/advisory/013a60"
        }
      ],
      "source": {
        "advisory": "GHSA-j8jg-7fqf-4xx9",
        "discovery": "UNKNOWN"
      },
      "title": "ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50576",
    "datePublished": "2026-08-18T16:49:43.358Z",
    "dateReserved": "2026-06-04T21:34:34.427Z",
    "dateUpdated": "2026-08-18T19:07:45.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}