CVE-2026-50577: ePA 3.x Integration Disclosure Flaw

CVE-2026-50577 Overview

CVE-2026-50577 affects fbeta-GmbH's ePA 3.x Integration, a component that handles the authorization workflow and writes Medical Information Objects to Germany's electronic patient record (elektronische Patientenakte). Versions prior to 1.3.0 leave the request_counter unchanged in app/vau/VAUProtokoll.py when constructing VAU (Vertrauenswürdige Ausführungsumgebung) protocol messages. The frozen counter causes the server to reuse AES-GCM nonce and key combinations across responses, breaking the authenticated encryption guarantees.

Critical Impact
A network attacker who collects repeated ciphertexts can recover plaintext patient health records and forge authenticated responses through the Joux forbidden attack.

Affected Products

fbeta-GmbH ePA 3.x Integration versions prior to 1.3.0
Deployments writing Medical Information Objects to the German electronic patient record
VAU protocol implementations using app/vau/VAUProtokoll.py

Discovery Timeline

2026-08-18 - CVE-2026-50577 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-50577

Vulnerability Analysis

The vulnerability stems from broken cryptographic state management in the VAU protocol implementation. The client fails to increment request_counter between requests, which the server incorporates into AES-GCM (Galois/Counter Mode) nonce derivation. When nonces repeat under the same key, AES-GCM loses both confidentiality and integrity guarantees.

Attackers who observe two ciphertexts encrypted with the same key and nonce can XOR them to obtain the XOR of the underlying plaintexts. VAU inner messages contain predictable HTTP headers and structured JSON fields, giving the attacker enough known plaintext to recover sensitive medical data, including patient health records.

Beyond confidentiality loss, nonce reuse enables the Joux forbidden attack. Attackers can recover the GHASH authentication subkey H and forge arbitrary AES-GCM messages under the compromised session. This lets them inject malicious responses into the ePA workflow. A parallel defect leaves last_response_counter unmaintained, weakening replay and message-ordering validation.

Root Cause

The root cause is a missing counter increment in app/vau/VAUProtokoll.py, classified as [CWE-323] Reusing a Nonce, Key Pair in Encryption. The class initialized request_counter to zero and never advanced it, and it did not track last_response_counter for response validation.

Attack Vector

Exploitation requires network positioning to capture ePA VAU traffic between client and server. The attacker collects multiple VAU responses encrypted under the reused nonce/key pair, then performs offline cryptanalysis to recover plaintext and the GHASH key. With the forged authentication capability, the attacker can inject responses containing malicious authorization decisions or altered medical records.

python

# Security patch in app/vau/VAUProtokoll.py
# Source: https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/85c4c516088c38b9cf2343f388ad67a6744e9814

            self.encryption_counter = 0
            self.request_counter = 0
+           self.last_response_counter = 0

            assert self.AS_URL
            assert self.AS_URL.startswith("http://") or self.AS_URL.startswith("https://")

The fix introduces last_response_counter initialization; the accompanying pull request also ensures request_counter is advanced on each VAU message so nonce/key pairs are never reused.

Detection Methods for CVE-2026-50577

Indicators of Compromise

Repeated AES-GCM nonces observed in VAU protocol traffic captured between ePA clients and Aktensystem endpoints.
Unexpected or malformed VAU responses that pass authentication despite integrity anomalies, indicating potential forged messages.
ePA 3.x Integration deployments running versions earlier than 1.3.0 without the last_response_counter field in VAUProtokoll.py.

Detection Strategies

Inspect deployed ePA 3.x Integration builds and confirm the presence of the 1.3.0 release or later.
Instrument VAU protocol logging to record request and response counter values, alerting on stalled or non-monotonic counters.
Perform network-side telemetry review for repeated 12-byte GCM nonces across sessions using packet capture on TLS-terminated inspection points.

Monitoring Recommendations

Continuously monitor outbound VAU traffic for repeated ciphertext prefixes that suggest nonce reuse.
Track ePA session establishment logs and correlate them with counter progression to identify sessions that never advance state.
Alert on VAU decryption failures spikes, which may indicate active forgery attempts leveraging recovered GHASH keys.

How to Mitigate CVE-2026-50577

Immediate Actions Required

Upgrade ePA 3.x Integration to version 1.3.0 or later immediately, as documented in the GitHub Security Advisory GHSA-vmfm-3f7g-r9qg.
Rotate any long-lived credentials or keys that traversed the vulnerable VAU sessions to limit downstream impact.
Review historical VAU traffic captures for evidence of nonce reuse and treat affected sessions as potentially compromised.

Patch Information

The fix is delivered in ePA 3.x Integration version 1.3.0 via pull request #10 and commit 85c4c51. The patch initializes last_response_counter and advances request_counter so AES-GCM nonces remain unique per key. Additional technical background is available in the Machine Spirits advisory DF27CD.

Workarounds

No supported workaround exists; the cryptographic defect requires the code changes shipped in 1.3.0.
If patching is delayed, restrict network reachability to the ePA integration service and enforce mutual TLS to limit passive traffic collection.
Reduce VAU session lifetime to minimize the number of ciphertexts encrypted under any reused nonce/key pair.

bash

# Verify installed ePA 3.x Integration version
git -C /opt/ePA3-Service-OpenSource describe --tags
# Expected output: 1.3.0 or later