The vulnerability allows an authenticated attacker to inject arbitrary HTTP headers into internal requests by controlling values that are not neutralized for CRLF characters. This insertion can add headers such as x-insurantid or Authorization, potentially exposing another patient's records or bypassing authentication constraints. The injected headers are then forwarded to the ePA server, compromising confidentiality, integrity, and access control.

Products from fbeta‑GmbH, specifically ePA3‑Service‑OpenSource, are affected whenever a version prior to 1.3.0 is deployed. The flaw resides in the app/vau/VAUProtokoll.py component which constructs inner HTTP requests for the electronic patient record workflow. All installations using the vulnerable code path are susceptible.

The CVSS score of 6.8 indicates a medium severity. The EPSS score is unavailable, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires authentication and control over certain input fields that are reflected in request headers; the likely attack vector is through normal application use by a legitimate user who can supply crafted data. When exploited, it can lead to data disclosure and unauthorized access, though the extent depends on the downstream ePA server’s handling of injected headers.