CVE-2026-48021 Security feature bypass in epa4all
Attackers can intercept TLS connections to read and modify sensitive patient data and inject requests due to missing certificate and hostname checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48021?
CVE-2026-48021 is a critical vulnerability in med-united epa4all, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.
Which versions are affected by CVE-2026-48021?
How do I fix CVE-2026-48021?
No fix has been published for CVE-2026-48021 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48021 being exploited?
There is no known exploitation of CVE-2026-48021 in the wild and no public exploit code.
Sources
Also known as GHSA-vvh7-x6c7-46gh.