CVE-2026-50577

The record

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.

Affected packages

Related vulnerabilities

• CVE-2026-17578 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation… CWE-323
• CVE-2026-21383 Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping… CWE-323
• CVE-2026-56369 ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the… CWE-323
• CVE-2026-55967 AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64… CWE-323
• CVE-2026-12205 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… CWE-323
• CVE-2026-49952 Discuz! CWE-323
• GHSA-qv2q-c278-pch5 ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse CWE-323
• CVE-2026-45028 Astro is a web framework. CWE-323