CVE-2026-50577: ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves requestcounter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain lastresponsecounter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ePA 3.x Integrationto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Which versions need remediation?
Deploy version 1.3.0 or later. The issue affects versions prior to 1.3.0.
What attacker access is required?
An attacker needs network access to collect repeated VAU ciphertexts. No privileges or user interaction are required according to the supplied vector.
What could an attacker do after collecting affected traffic?
Repeated AES-GCM nonce and key use can expose plaintext relationships and, with predictable HTTP headers or JSON fields, sensitive data including patient health records. It may also permit AES-GCM message forgery and malicious response injection, while weakened response-counter tracking reduces replay and ordering validation.