Critical severity9.3NVD Advisory· Published Mar 27, 2026· Updated Apr 3, 2026

CVE-2026-33875

Description

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

Affected products

Gematik/Authenticator
cpe:2.3:a:gematik:authenticator:*:*:*:*:*:*:*:*
Range: <4.16.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmrnvdVendor Advisory
www.machinespirits.com/advisory/f41e56/nvd

News mentions

Millions of students’ personal data stolen in major education breach
Malwarebytes Labs · May 6, 2026
CloudZ RAT potentially steals OTP messages using Pheno plugin
Cisco Talos Intelligence · May 5, 2026

cvss	0.605
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000