CVE-2026-33875

CRITICAL

Authenticator Vulnerable to Authentication Flow Hijack

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-33875 has a selected CVSS score of 9.3 (critical).

Description

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 30, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

app-Authenticator

Browse gematik / app-Authenticator
CVE List< 4.16.0affected

References

2