Private keys embedded within the application are protected only by a shared password. When an attacker obtains this password or a copy of the keys, they can sign assertions for any practitioner identifier, creating valid practitioner tokens. This permits unauthorized access to patient or clinical data, undermining the confidentiality and integrity of the medical information system.

The vulnerability affects CompuGroup Medical products Infantia, Phronesis, Profim, and Venere. No specific version information is provided in the advisory.

The CVSS score of 8 indicates high severity, but the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack requires access to the protected private keys or the shared password; an internal attacker or one who has compromised the system could exploit the flaw to impersonate practitioners. Once a forged token is issued, the attacker can request privileged services under an arbitrary practitioner identity.