Vulnerability · Published Jul 24, 2026 · Assigned by GitHub_M

CVE-2026-54342TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

High 8.1

In plain English

A high-severity improper certificate validation in epa4all from med-united. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.

Affected products (as reported)

Vendor	Product	Versions
med-united	epa4all	< 2026-05-20

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/med-united/epa4all/security/advisories/GHSA-296w-v8f6-3rf7 x_refsource_CONFIRM
https://github.com/med-united/epa4all/security/advisories/GHSA-vvh7-x6c7-46gh x_refsource_MISC
https://github.com/med-united/epa4all/releases/tag/2026-05-20 x_refsource_MISC
https://www.machinespirits.com/advisory/b98b02 x_refsource_MISC