Gematik Authenticator Authentication Flow Hijacking Vulnerability

A vulnerability allowing authentication flow hijacking has been identified in Gematik Authenticator versions prior to 4.16.0. This issue could enable attackers to authenticate as victim users who engage with a malicious deep link.

Impact

Exploitation of this vulnerability could lead to unauthorized authentication, allowing attackers to impersonate users.

Remediation

Users are advised to update Gematik Authenticator to version 4.16.0 or greater. The updated version can be downloaded from the GitHub releases page or via the app store. Depending on the configuration, the authenticator may update automatically. To check the current version, open the application and look at the bottom right corner of the window.