CVE-2026-33874

Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version 4.16.0, the Mac OS version of the Authenticator is vulnerable to remote code execution, triggered when victims open a malicious file. Update the gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gematik/app-Authenticator/security/advisories/GHSA-mjgm-7hwc-qqcr	Vendor Advisory
https://www.machinespirits.de/advisory/2e655e/

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:gematik:authenticator:*:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Gematik Authenticator autentica de forma segura a los usuarios para iniciar sesión en aplicaciones de salud digitales. A partir de la versión 4.12.0 y antes de la versión 4.16.0, la versión para Mac OS del Authenticator es vulnerable a la ejecución remota de código, que se activa cuando las víctimas abren un archivo malicioso. Actualice el Authenticator de gematik a la versión 4.16.0 o superior para recibir un parche. No se conocen soluciones alternativas.

Information

Published : 2026-03-27 21:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-33874

Mitre link : CVE-2026-33874

CVE.ORG link : CVE-2026-33874

JSON object : View

Products Affected

apple

macos

gematik

authenticator

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-33874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T18:51:16.482628Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gematik", "product": "app-Authenticator", "versions": [{"status": "affected", "version": ">= 4.12.0, < 4.16.0"}]}]}], "published": "2026-03-27T21:17:24.213", "references": [{"url": "https://github.com/gematik/app-Authenticator/security/advisories/GHSA-mjgm-7hwc-qqcr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.machinespirits.de/advisory/2e655e/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version 4.16.0, the Mac OS version of the Authenticator is vulnerable to remote code execution, triggered when victims open a malicious file. Update the gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds."}, {"lang": "es", "value": "Gematik Authenticator autentica de forma segura a los usuarios para iniciar sesi\u00f3n en aplicaciones de salud digitales. A partir de la versi\u00f3n 4.12.0 y antes de la versi\u00f3n 4.16.0, la versi\u00f3n para Mac OS del Authenticator es vulnerable a la ejecuci\u00f3n remota de c\u00f3digo, que se activa cuando las v\u00edctimas abren un archivo malicioso. Actualice el Authenticator de gematik a la versi\u00f3n 4.16.0 o superior para recibir un parche. No se conocen soluciones alternativas."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gematik:authenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CABC71B-E563-463E-8D56-8FB5E430C88B", "versionEndExcluding": "4.16.0", "versionStartIncluding": "4.12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-advisories@github.com"}