CVE-2026-33875: 
NixOS vulnerability analysis and mitigation

CVE-2026-33875 is an authentication flow hijacking vulnerability in Gematik Authenticator, a desktop application used to securely authenticate users for login to digital health applications in Germany. The vulnerability affects all versions prior to 4.16.0 (specifically version 4.15.2 and earlier) and was published on March 27, 2026. It carries a CVSS v3.1 base score of 9.3 (Critical) with a changed scope, reflecting the potential for cross-component impact (GitHub Advisory, Feedly). The vulnerability was responsibly disclosed by Dr. Simon Weber and Volker Schönefeld from Machine Spirits UG through the gematik Coordinated Vulnerability Disclosure Program (GitHub Advisory).

The root cause is classified as CWE-940 (Improper Verification of Source of a Communication Channel): due to missing input validation on deep link parameters, the Authenticator does not verify that an incoming authentication request originates from a legitimate Identity Provider (IdP). An attacker crafts a malicious deep link containing a valid client ID and redirect URI of a target application, which — when clicked by a victim — forces the Authenticator to connect to an attacker-controlled host and initiate the authentication flow. The attacker's host acts as a relay (man-in-the-middle) between the Authenticator and the real IdP, intercepting intermediary token material returned upon successful authentication. If the victim's relevant smart card (SMC-B or HBA) is already unlocked and user consent is remembered for the target application, the attack can complete with no additional victim interaction beyond clicking the link (GitHub Advisory).

Successful exploitation allows an attacker to authenticate to digital health applications under the identity of the victim, resulting in full account takeover with high confidentiality and integrity impact. Sensitive health data accessible through the compromised identity may be exposed or manipulated, and the attacker can perform any action the victim is authorized to perform within the targeted application. Applications accessible on the public internet that use the Authenticator for logins are directly at risk; with network access to a Telematikinfrastruktur (TI) IdP, internally-facing applications could also be targeted (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.05%, reflecting a currently low probability of automated exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only that a victim click a malicious deep link — a condition easily achieved via phishing — making it exploitable at scale without any privileges on the attacker's part (GitHub Advisory).

1. Reconnaissance: Identify target applications that use Gematik Authenticator for login and obtain a valid client_id and redirect_uri for the target application (these may be discoverable from public application documentation or OAuth discovery endpoints).
2. Craft malicious deep link: Construct a deep link that instructs the Authenticator to initiate an authentication flow pointing to an attacker-controlled host instead of the legitimate IdP, embedding the valid client_id and redirect_uri of the target application.
3. Set up relay server: Deploy an attacker-controlled server that proxies HTTP traffic between the victim's Authenticator and the real IdP, capturing intermediary token material (e.g., authorization codes or tokens) returned during the authentication flow.
4. Deliver the link to the victim: Distribute the malicious deep link via phishing email, SMS, or other social engineering channels targeting users known to have Gematik Authenticator installed.
5. Victim clicks the link: The victim's Authenticator opens and initiates the authentication flow against the attacker's relay server. If the victim's smart card (SMC-B or HBA) is already unlocked and consent is pre-remembered, authentication may complete automatically.
6. Intercept token material: The attacker's relay captures the intermediary tokens or authorization codes returned by the real IdP upon successful authentication.
7. Authenticate as victim: The attacker uses the intercepted token material to authenticate to the target digital health application under the victim's identity, gaining full unauthorized access (GitHub Advisory).

• Network: Outbound connections from the Gematik Authenticator process to unexpected or unknown hosts during an authentication session (i.e., hosts other than the configured legitimate IdP endpoints); unusual OAuth/OIDC redirect traffic to non-standard domains.
• Logs: Authentication events in application or IdP logs showing successful logins from unexpected IP addresses or at unusual times not correlated with known user activity; OAuth token issuance logs showing token requests relayed through an intermediate host.
• Process/Application: Gematik Authenticator launching unexpectedly without user-initiated login action, particularly following receipt of a deep link via email or messaging application.
• User Reports: Victims reporting unexpected authentication prompts or Authenticator windows opening without their initiation, or discovering unauthorized sessions in digital health applications (GitHub Advisory).

The only remediation is to update Gematik Authenticator to version 4.16.0 or greater, which introduces proper input validation on deep link parameters. The updated version is available from the GitHub releases page and through configured app stores; depending on configuration, the Authenticator may update itself automatically. There are no known workarounds or mitigations for unpatched versions. As a supplementary measure, organizations should educate users to avoid clicking unsolicited deep links and consider restricting deep link handling at the OS or endpoint level where feasible (GitHub Advisory, Feedly).

The vulnerability received coverage from The Hacker Wire shortly after disclosure, and was noted on social platforms including Mastodon and Bluesky (The Hacker Wire). The ENISA European Vulnerability Database (EUVD) catalogued the vulnerability as EUVD-2026-16817, and it was tracked by VulDB and the German CVE database (gcve.eu). Community sentiment reflects concern given the healthcare context and the high CVSS score, with security researchers highlighting the phishing-exploitable nature of the attack vector.