CVE-2026-50576

Name of the Vulnerable Software and Affected Versions ePA 3.x Integration versions prior to 1.3.0

Description The software fails to neutralize CRLF (Carriage Return Line Feed) characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build inner header() function interpolates the uri, host, accept type, content type, content length, USER AGENT, and insurant id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker controlling these values can inject additional headers into the inner request. Depending on the server handling, an injected x-insurantid header may expose other patients' records, while injected Authorization headers could bypass authentication or authorization contexts. Additionally, session-derived USER AGENT input can lead to request poisoning across the session.

Recommendations Update ePA 3.x Integration to version 1.3.0.