The issue arises because ePA 3.x Integration disables TLS certificate verification for both ePA and Konnektor connections. As a result, a man‑in‑the‑middle attacker can present a self‑signed or otherwise unverified certificate, terminate the TLS session, and capture all ePA traffic. Because the VAU protocol also performs broken application‑layer certificate validation, there is no fallback to enforce proper authentication. Additionally, in the Konnektor session the client authenticates with a mutual TLS certificate while certificate verification is turned off, enabling an attacker impersonating the Konnektor to obtain the client’s smartcard operations. This flaw is a classic example of CWE‑295, improper certificate validation.

Affected versions are the ePA 3.x Integration in the fbeta‑GmbH ePA3‑Service‑OpenSource product released before version 1.3.0. The vendor identifies the product as fbeta‑GmbH:ePA3‑Service‑OpenSource and the fix was introduced in release 1.3.0.

The CVSS score of 7.5 reflects a high confidentiality impact. The EPSS score is not available, but lack of a public KEV listing suggests limited known exploitation at this time. However, an attacker with network access can readily craft a rogue certificate and intercept sensitive medical data. Because the vulnerability disables critical TLS checks entirely, the solution is to apply the vendor’s patch or upgrade to 1.3.0; failing that, network isolation or strict IP filtering can mitigate risk.