CVE-2026-52723

Name of the Vulnerable Software and Affected Versions ePA 3.x Integration versions prior to 1.3.0

Description The software performs VAU server certificate validation in the app/vau/VAUProtokoll.py file without anchoring the signed vau server pub keys and AUT VAU CertData certificate path to independent trusted material. Additionally, TLS certificate verification is disabled. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake and provide attacker-controlled certificate and key material to satisfy a circular trust relationship. This allows the attacker to impersonate the VAU server, control negotiated session keys, and read or modify all encrypted VAU traffic.

Recommendations Update to version 1.3.0.