CVE-2026-50578

Versions of ePA 3.x Integration before 1.3.0 disable TLS certificate verification (self.session.verify=False) in app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py, allowing a network attacker to present arbitrary certificates, terminate TLS, and intercept or observe mutual-TLS smartcard exch...

PT-2026-77219

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The buil...