CVE-2026-54342

The CVE affects epa4all prior to 2026-05-20, where TLS certificate verification is disabled on CXF transport clients. A network attacker can intercept connections between epa4all and backends (ePA Aktensystem, Konnektor, IDP, TSS) by presenting a self-signed certificate. For non-VAU backends (Kon...