CVE-2026-52723

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestjgtg72p 2026-08-18 19:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6fc7cl2j...

CVE-2026-52723

In ePA 3.x Integration versions prior to 1.3.0, app/vau/VAUProtokoll.py validates the VAU server certificate without anchoring it to independent trusted material, creating a circular trust relationship. Combined with disabled TLS certificate verification, a network-positioned attacker can interce...

CVE-2026-52723 ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...