CVE-2026-33875 - Vulnerability Analysis

Overview

Gematik Authenticator < 4.16.0 contains an authentication bypass caused by authentication flow hijacking via malicious deep links, letting attackers authenticate as victim users, exploit requires victim user interaction.

Severity & Score

Impact

Attackers can authenticate as victim users, potentially gaining unauthorized access to their accounts.

Mitigation

Update to version 4.16.0 or later.

References

• https://github.com/gematik/app-Authenticator/security/advisories/GHSA-qg87-cf56-2rmr

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 28, 2026

🚨 CVE-2026-33875 (CRITICAL, CVSS 9.3): gematik app-Authenticator <4.16.0 is vulnerable to authentication hijack via malicious deep links. No workarounds — update to 4.16.0+ urgently! https://radar.offseq.com/threat/cve-2026-33875-cwe-940-improper-verification-of-so-189b5f61 #OffSeq #CVE202633875 #HealthIT #VulnAlert

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner