epa4all vulnerabilities

2 known vulnerabilities in epa4all from Med-united. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  epa4all: Improper Certificate Validation

  CVE-2026-54342Jul 24, 2026Med-united

  In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), th

• 9.1 Critical severity

  epa4all: Improper Certificate Validation

  CVE-2026-48021Jul 24, 2026Med-united

  In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient c