The vulnerability arises from ePA 3.x Integration leaving the request_counter unchanged in VAUProtokoll.py; as a result the message nonce and key combinations are reused across multiple responses. This nonce reuse violates AES‑GCM’s core assumption that a nonce must be unique for a given key, allowing an attacker who can observe more than one ciphertext to recover the XOR of the corresponding plaintexts. With predictable HTTP headers and JSON fields, the XOR leak can directly expose sensitive patient health records. In addition, replay of repeated nonces enables the Joux forbidden key‑recovery attack, allowing the attacker to recover the GHASH authentication key and forge AES‑GCM messages, thereby injecting malicious responses. Thus the impact includes confidentiality and integrity compromise of transmitted medical data.

Affected vendors and products include fbeta‑GmbH’s ePA3‑Service‑OpenSource implementation of the integration workflow for Germany’s electronic patient record system. All releases prior to version 1.3.0 are impacted, as the code that updates request_counter and last_response_counter was not applied. The issue is fixed in ePA 3.x Integration release 1.3.0 and any later revision that incorporates the patch commit 85c4c516088c38b9cf2343f388ad67a6744e9814.

The CVSS score of 7.4 denotes a medium‑to‑high severity vulnerability. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, but the technical nature of nonce reuse combined with the ability of a network attacker to gather multiple ciphertexts makes exploitation plausible in environments where the ePA service is exposed to untrusted networks. Exploitation would require passive network visibility and no special privileges; once sufficient encrypted responses are collected, an attacker can extract portions of the plaintexts and eventually derive the authentication key to fabricate arbitrary responses. Therefore, although the EPSS figure is unknown, the combination of a high CVSS score and a known, easy‑to‑reproduce attack path warrants immediate attention from affected customers.