OPENEMR · CVE-2026-124445 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR from 7.0.1 before 8.4.0 ignores its one-time-use and access-count flags for service_auth tokens and never revokes consumed tokens. It also checks the login PIN without rate limiting or strict comparison, so an attacker holding a captured token can replay it or guess the PIN to open patient-portal sessions that expose protected health information.
first public Sep 13, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clinics and organizations running OpenEMR 7.0.1 through 8.3.x with the patient portal and service_auth tokens in use. The sources do not say whether the flaw is reachable without portal or token features enabled, so treat any patient-portal deployment in that version range as exposed.
Not affected if version-8.4.0-or-later
Who cares healthcare, openemr, patient-portal, self-hosted
7.0.1 up to but not including 8.4.0 is affected.src/Common/Auth/OneTimeAuth.php in your installed copy for the flag handling described.8.4.0 or later.OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.