by Kastro
Paper/Archive/CVE-2026-33875

CVE-2026-33875

gematik app-Authenticator — Authenticator Vulnerable to Authentication Flow Hijack

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 19.2.192 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

Affected

ProductAffectedFixed inSource
app-Authenticator< 4.16.0–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmrrefmachinespirits.com/advisory/f41e56