Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-44900epa4all-client: VAU Signature bypass

High 8.1

In plain English

A high-severity improper certificate validation in epa4all-client from com.oviva.telematik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.1%top 98.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true. This vulnerability is fixed in 1.2.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.oviva.telematik:epa4all-client	1.2.1	GHSA-g8r3-5hwf-qp96

Affected products (as reported)

Vendor	Product	Versions
oviva-ag	epa4all-client	< 1.2.1
com.oviva.telematik	epa4all-client	< 1.2.1

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-g8r3-5hwf-qp96 x_refsource_CONFIRM
https://github.com/oviva-ag/epa4all-client/pull/34 x_refsource_MISC