GHSA-5HHF-XMFX-4VVR epa4all-client: TLS Certificate Validation Disabled in Production

Impact An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate self-signed, expired, wrong CN and intercept all SOAP traffic. This includes patient identifiers KVNR, SMC-B card operations authentication, signing, document content, and credential...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to disabled TLS certificate validation in production environments. An attacker can intercept sensitive SOAP traffic, including patient identifiers, authentication operations, document content, and...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to disabled TLS certificate validation in production environments. An attacker can intercept sensitive SOAP traffic, including patient identifiers, authentication operations, document content, and...

com.oviva.telematik:epa4all-client (>=1.0.0 <=1.2.0), com.oviva.telematik:epa4all-rest-service (>=1.0.0 <=1.2.0) +2 more potentially affected by CVE-2026-44900 via com.oviva.telematik:vau-httpclient (>=1.0.0 <=1.2.0)

com.oviva.telematik:vau-httpclient MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17157661...

com.oviva.telematik:epa4all-rest-service (>=0.0.4 <=1.2.0) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (>=0.0.4 <=1.2.0)

com.oviva.telematik:epa4all-client MAVEN version =0.0.4, =0.0.4, =1.2.0 Source cves: CVE-2026-44900 Source advisory: OSV:GHSA-G8R3-5HWF-QP96...