Plaintext recovery and forgery via nonce reuse

Improper nonce management in ePA 3.x Integration before 1.3.0 allows network attackers to read and forge VAU-protected responses. In app/vau/VAUProtokoll.py, send_vau_message() increments encryption_counter but leaves request_counter unchanged when constructing outgoing VAU messages, so the peer reuses AES-GCM nonce and key pairs; the same file also validated response counters against request_counter instead of tracking last_response_counter. Exploitation requires network visibility into repeated ciphertexts, and predictable inner HTTP headers and JSON fields let attackers recover patient-record plaintext while GHASH key recovery can support forged responses and weaker replay protection.