CVE-2026-50578: ePA 3.x Integration: TLS Certificate Verification Universally Disabled
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ePA 3.x Integrationto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Which deployments need remediation?
Deployments running versions prior to 1.3.0 are affected. Version 1.3.0 fixes the issue.
What access does an attacker need to exploit this?
A network-positioned attacker can exploit the issue without authentication or user interaction by presenting an arbitrary certificate and terminating the TLS connection. This can expose ePA traffic and allow impersonation of the Konnektor.
Does the VAU protocol mitigate the disabled TLS verification?
The affected code disables TLS certificate verification for both ePA and Konnektor connections, and the VAU protocol's application-layer certificate validation is also broken. As a result, the described workflow does not provide an effective certificate-validation safeguard in affected versions.
What information or operations could be exposed?
An attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. The issue can also allow interception of ePA traffic, including traffic related to authorization workflows and Medical Information Objects.