TLS Vulnerability in epa4all-client Java Client by oviva

CVE-2026-45575

What is CVE-2026-45575?

The epa4all-client, a Java Client for the epa4all / ePA 3.0 within the Telematik Infrastruktur, is susceptible to man-in-the-middle (MITM) attacks. Attackers capable of intercepting the TLS connection between the client and the identity provider (IDP) can replace the legitimate discovery document with a malicious one. This spoofed document can redirect critical URLs to those controlled by the attacker. Consequently, the client may unintentionally encrypt and transmit sensitive authentication information to the attacker, jeopardizing user credentials and security. The vulnerability has been addressed in version 1.2.2.

References