fbeta ePA3-Service-OpenSource up to 1.2.x VAU Protocol app/vau/VAUProtokoll.py certificate validation

Summaryinfo

A vulnerability was found in fbeta ePA3-Service-OpenSource up to 1.2.x. It has been declared as problematic. Affected is an unknown function of the file app/vau/VAUProtokoll.py of the component VAU Protocol. Executing a manipulation can lead to certificate validation. This vulnerability is tracked as CVE-2026-52723. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in fbeta ePA3-Service-OpenSource up to 1.2.x. This vulnerability affects some unknown processing of the file app/vau/VAUProtokoll.py of the component VAU Protocol. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-52723 since 06/08/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 1.3.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• fbeta

Name

• ePA3-Service-OpenSource

Version

• 1.0
• 1.1
• 1.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion