CVE-2026-45575 Overview
CVE-2026-45575 affects epa4all-client, the Java client for epa4all / ePA 3.0 used within the German Telematik Infrastruktur (TI). Versions prior to 1.2.2 fail to validate the integrity of the OpenID Connect discovery document retrieved from the Identity Provider (IDP). An attacker positioned to intercept the TLS connection between the client and the IDP can substitute a forged discovery document, redirecting the uri_puk_idp_enc and uri_puk_idp_sig endpoints to attacker-controlled URLs. This causes the client to encrypt SMC-B-signed challenge responses to the attacker's key and submit them to the attacker's authentication endpoint, exposing signed authentication material.
Critical Impact
An attacker with a man-in-the-middle position inside the TI network can capture SMC-B-signed authentication material, enabling impersonation of healthcare providers within ePA 3.0.
Affected Products
- epa4all-client Java client for ePA 3.0 versions prior to 1.2.2
- Deployments integrating epa4all-client with the Telematik Infrastruktur IDP
- Healthcare provider systems relying on SMC-B authentication through epa4all-client
Discovery Timeline
- 2026-05-26 - CVE-2026-45575 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45575
Vulnerability Analysis
The flaw is an improper verification of cryptographic signature [CWE-347] in the discovery document handling logic of epa4all-client. The OpenID Connect discovery document defines the URLs the client uses to fetch the IDP's encryption (uri_puk_idp_enc) and signing (uri_puk_idp_sig) public keys. The client trusts the discovery document based solely on the TLS channel, without verifying a separate signature over the document content. An attacker capable of intercepting or compromising the TLS connection within the TI network can substitute fields in the document and redirect key retrieval to attacker-controlled hosts.
Root Cause
The client does not cryptographically verify the discovery document independently of the transport channel. Because the URIs for the IDP public keys are taken from the discovery document at runtime, tampering with those fields changes which keys the client trusts. Reliance on TLS alone for authenticity makes the attack feasible whenever the attacker can interpose on the TLS session.
Attack Vector
The attacker establishes a man-in-the-middle position on the TLS connection between epa4all-client and the TI IDP. The attacker returns a modified discovery document with uri_puk_idp_enc and uri_puk_idp_sig pointing to attacker-controlled URLs. The client fetches the attacker's encryption key, encrypts the SMC-B-signed challenge response to that key, and POSTs it to the attacker's authentication endpoint. The attacker decrypts the payload and obtains signed authentication material usable to impersonate the healthcare provider.
No proof-of-concept code is published. Technical details are available in the GitHub Security Advisory GHSA-gqx7-6552-67hf and the remediation pull request.
Detection Methods for CVE-2026-45575
Indicators of Compromise
- Outbound HTTPS connections from epa4all-client hosts to domains other than the documented TI IDP endpoints
- Discovery document responses containing uri_puk_idp_enc or uri_puk_idp_sig values that resolve outside the approved TI namespace
- Authentication POST requests directed at unexpected hosts shortly after discovery document retrieval
Detection Strategies
- Pin and inventory the expected IDP hostnames and compare every observed uri_puk_idp_* value against the allow-list
- Monitor TLS certificate chains presented by the IDP endpoint for unexpected issuers or changes in certificate fingerprints
- Alert on epa4all-client versions below 1.2.2 discovered through software inventory scans
Monitoring Recommendations
- Enable verbose logging of discovery document fields and forward logs to a central SIEM for correlation
- Track DNS resolutions and egress destinations from systems running epa4all-client and flag deviations from baseline
- Audit IDP authentication flows for anomalous timing or endpoint redirection sequences
How to Mitigate CVE-2026-45575
Immediate Actions Required
- Upgrade epa4all-client to version 1.2.2 or later on every host that integrates with the TI IDP
- Rotate any SMC-B credentials suspected of exposure through prior authentication flows
- Review network paths between client deployments and the TI IDP for unauthorized interception points
Patch Information
The issue is fixed in epa4all-client version 1.2.2. The corrective change is tracked in the upstream GitHub Pull Request #36, which adds verification of the discovery document so that forged key URIs are rejected. Operators should pull the patched release from the project's distribution channel and redeploy affected services.
Workarounds
- Restrict outbound network egress from epa4all-client hosts to an explicit allow-list of TI IDP endpoints
- Enforce strict TLS certificate pinning to the legitimate TI IDP at the network or application layer
- Isolate epa4all-client workloads on segmented networks that limit exposure to MITM positions within the TI
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
