CVE-2026-33875

Katalog CVE

CVSS 9.3 · Critical EPSS 0,47%

Kerentanan Improper Verification of Source of a Communication Channel pada gematik authenticator. Skor CVSS 3.1 9.3 (Critical) menurut github.com.

Deskripsi (NVD)

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.3 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-940: Improper Verification of Source of a Communication Channel

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmr advisory vendor
• https://www.machinespirits.com/advisory/f41e56/