TLS Verification Bypass in ePA 3.x Integration by fbeta GmbH

CVE-2026-50578

What is CVE-2026-50578?

The ePA 3.x Integration by fbeta GmbH has a critical vulnerability that leads to TLS certificate verification being disabled in crucial components of the system. Specifically, in versions prior to 1.3.0, both app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py fail to validate TLS certificates properly. This flaw enables attackers positioned within the network to present forged certificates, compromise TLS connections, and intercept sensitive ePA data traffic. The vulnerability extends to both the VAU protocol and Konnektor sessions, allowing malicious actors to impersonate the Konnektor and gain access to the client's mutual TLS certificate exchange, thus observing smartcard operations. The issue has been addressed in version 1.3.0, emphasizing the importance of maintaining updated software.

References