fbeta Epa3-Service-Opensource up to 1.2.x TLS Certificate Verification app/vau/VAUProtokoll.py certificate validation

Summaryinfo

A vulnerability, which was classified as problematic, was found in fbeta Epa3-Service-Opensource up to 1.2.x. The affected element is an unknown function of the file app/vau/VAUProtokoll.py of the component TLS Certificate Verification. The manipulation results in certificate validation. This vulnerability was named CVE-2026-50578. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in fbeta Epa3-Service-Opensource up to 1.2.x. It has been classified as problematic. Affected is some unknown functionality of the file app/vau/VAUProtokoll.py of the component TLS Certificate Verification. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. CVE summarizes:

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-50578 since 06/04/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 1.3.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• fbeta

Name

• Epa3-Service-Opensource

Version

• 1.0
• 1.1
• 1.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion