TLS Vulnerability in epa4all Affects Secure Data Transmission

CVE-2026-48021

What is CVE-2026-48021?

A serious TLS vulnerability exists in epa4all prior to version 2026-05-20, allowing attackers who can intercept the TLS connection to execute a VAU handshake utilizing their own keys. This allows unauthorized access to session encryption keys, rendering all inner HTTP traffic—such as patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries—readable and modifiable by the attacker. Additionally, the compromised channel can be exploited to inject arbitrary requests. The issue has been addressed in the version 2026-05-20 release.

References