CVE-2026-33875

critical · 9.3

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

9.3

CVSS

0.3%

EPSS (exploit prob.)

19th

EPSS percentile

2026-03-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-940

Affected products

Vendor	Product	Affected versions
gematik	authenticator	< 4.16.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmr
https://www.machinespirits.com/advisory/f41e56/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-33875