Gematik Authenticator versions earlier than 4.16.0 allow an attacker to hijack the authentication flow through a malicious deep link, enabling the attacker to log in as the victim user. This leads to identity impersonation and unauthorized access to digital health applications, compromising user confidentiality and integrity. The weakness is identified as CWE‑940.

Gematik Authenticator (app-Authenticator) for all versions prior to 4.16.0. The vulnerability affects the authentication process used by digital health applications that rely on this authenticator.

The flaw carries a CVSS score of 9.3, indicating high severity, but the EPSS score is below 1% and it is not listed in CISA's KEV catalog, suggesting exploitation is unlikely in the near term. The attack vector appears to require the victim to click a malicious deep link, so it is a user‑interaction attack that can be staged through phishing. Because of the high impact and the low probability but potential for exploitation, organization should address it promptly.