A high-severity flaw in med-united epa4all permits man-in-the-middle attacks, potentially exposing sensitive backend communication to interception.

This is an improper certificate validation vulnerability (CWE-295) where the application fails to verify the authenticity of TLS connections. An unauthenticated attacker positioned on the network path can intercept traffic between the software and its backends.

Successful exploitation allows an attacker to intercept, view, or manipulate sensitive data transmitted between epa4all and critical backends like the ePA Aktensystem or IDP. With a CVSS score of 8.1, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to medical records or system credentials.

Immediate Action: Update epa4all to version 2026-05-20 or later to implement proper TLS certificate validation.

Proactive Monitoring: Monitor network traffic for suspicious TLS handshakes or unexpected certificate warnings originating from the application server.

Compensating Controls: Ensure network segmentation is in place to minimize the number of entities capable of performing a man-in-the-middle attack on the path between the application and its backends.

Public Exploit Available: Unknown.

The vulnerability poses a severe threat to the confidentiality of backend communications. Organizations must prioritize updating to version 2026-05-20 immediately to secure the transport layer and prevent potential data interception.