CVE-2026-48021

· CRITICALDeferred

← All CVEs

CVSS v3.1

9.1

EPSS

0.12%

Published

Jul 24, 2026

Modified

Jul 30, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-295CWE-347

References (3)

https://github.com/med-united/epa4all/releases/tag/2026-05-20

https://github.com/med-united/epa4all/security/advisories/GHSA-vvh7-x6c7-46gh

https://www.machinespirits.com/advisory/aa49f0

KEV Catalog EPSS Scores Vendors All CVEs