VAU Signature Verification Bypass

Description

var ecdsa = Signature.getInstance("SHA256withECDSA", BouncyCastleProvider.PROVIDER_NAME);
ecdsa.initVerify(certs.cert());
ecdsa.update(signedPublicKeys.signedPubKeys());

var signatureDer = ECDSA.transcodeSignatureToDER(signedPublicKeys.signatureEs256());
ecdsa.verify(signatureDer);

// falls through to:
return true;

return sig.verify(derSignature);

Impact

• An attacker on the same network as an ePA client (for example, the local clinic network where the ePA connector lives) substitutes their own ECDH and Kyber public keys into the VAU handshake. The client derives session keys from the attacker's keys, granting full plaintext access to ePA traffic: document writes, document reads, and authorization flows.
• During testing, a single relay captured the upstream server's genuine certificate and OCSP response, presented them alongside attacker-controlled VAU keys whose signature did not verify, and completed the M1-M4 handshake; it then read one patient's consent decisions, modified a second response, and injected a third patient's record over the one hijacked channel.

Mitigation

Update epa4all-client to 1.2.1 or later. The fix reads the boolean result of Signature.verify() and returns false when the signature does not match, instead of discarding it. Add a unit test that asserts isTrusted() returns false for an invalid signature; at the time of disclosure the handshake tests bypassed signature verification with a permissive s -> true lambda, so the discard was never exercised.

Defender's Checklist

• Update epa4all-client to 1.2.1 or later.

  Every published version through 1.2.0 is affected. The fix is pull request #34: read the Signature.verify() result and fail closed.

• Grep your own forks for discarded verify() calls.

  Any verify(...) whose boolean result is not read is equivalent to no check. Search for Signature.verify, .verify( on JWS/JWT verifiers, and similar across your VAU and IDP code paths.

• Add a negative test for the trust validator.

  Assert that isTrusted() returns false for a structurally valid but wrong signature. Tests that stub trust with a s -> true lambda never exercise the real validator and will pass against the vulnerable code.

• Test with a self-signed peer.

  Stand up a local VAU peer that returns attacker-controlled public keys with a signature that does not match. The client must refuse the handshake.

Severity Reasoning

References

• CVE-2026-44900 (NVD)
• GHSA-g8r3-5hwf-qp96 (Oviva)
• Oviva epa4all-client PR #34 (fix)
• Oviva epa4all-client Repository
• Related upstream: VAU Handshake Performs Only 2 of 6 Required Server-Key Checks
• Related: ePA-VAU Client Security overview

How We Can Help

• MDR Penetration Testing