Oviva-ag vulnerabilities
We track 3 vulnerabilities in Oviva-ag products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2026.
Latest Oviva-ag vulnerabilities
- 8.1 High severity
epa4all-client: Improper Certificate Validation
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all
- 8.1 High severity
epa4all-client: Improper Certificate Validation
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The
- 7.4 High severity
epa4all-client: Improper Verification of Cryptographic Signature
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document. The forged do