EUVD-2026-52348
GHSA-g6r6-jr7g-hg95
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint exploitable with valid credentials only (PR:L, AC:L); high confidentiality and integrity impact on PHI; no availability impact or scope change observed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.
AnalysisAI
OpenEMR through 8.2.0 exposes an OAuth2 password grant pathway that fully bypasses multi-factor authentication for any user with valid credentials, because the unauthenticated dynamic client registration endpoint allows an attacker to mint a first-party OAuth2 client and exchange legitimate credentials for an API access token without triggering the MFA challenge enforced on the normal web login interface. Any organization using OpenEMR's MFA controls to protect sensitive patient health information (PHI) is exposed: the control is structurally bypassed at the OAuth2 layer regardless of how MFA is configured in the web UI. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Valid OpenEMR username and password credentials are required - without them, the password grant will fail and no token is issued; fully unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the threat profile: network-exploitable, low complexity, requiring only valid user credentials, with high confidentiality and integrity impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid OpenEMR credentials - through phishing, credential stuffing against a reused password, or insider access - sends an unauthenticated HTTP POST to the dynamic client registration endpoint to self-register a malicious OAuth2 client, then immediately submits a password grant request using the new client credentials combined with the stolen user credentials, receiving a valid API access token without any MFA challenge. With the bearer token in hand, the attacker queries the OpenEMR FHIR API to read or exfiltrate patient records, modify clinical data, or pivot to further access. … |
| Remediation | No vendor-released patch with a confirmed fix version is identified in the available intelligence at time of analysis; administrators should monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/openemr-oauth2-password-grant-authentication-bypass-via-smart-configuration and the official OpenEMR project for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all OpenEMR deployments and determine which versions are affected (8.2.0 and earlier); enable detailed audit logging of OAuth2 token requests and client registrations; notify compliance and legal teams of potential PHI exposure requiring breach assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Same weakness CWE-308 – Use of Single-factor Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today