{"id":"CVE-2026-124445","kind":"vulnerability","aliases":["CVE-2026-124445"],"related":[],"title":"OpenEMR: one-time login tokens can be replayed and PINs brute-forced","description":"OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.","summary":"OpenEMR from 7.0.1 before 8.4.0 ignores its one-time-use and access-count flags for service_auth tokens and never revokes consumed tokens. It also checks the login PIN without rate limiting or strict comparison, so an attacker holding a captured token can replay it or guess the PIN to open patient-portal sessions that expose protected health information.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","patient-portal","runtime","self-hosted"],"not_affected_if":["version-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version: `7.0.1` up to but not including `8.4.0` is affected.\n- Review `src/Common/Auth/OneTimeAuth.php` in your installed copy for the flag handling described.","fix":"- OpenEMR: upgrade to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:48:47+00:00","updated_at":"2026-11-08T14:48:47+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T14:48:47Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.4.0` or later.","reach":"internet","title":"OpenEMR: one-time login tokens can be replayed and PINs brute-forced","impact":"high","summary":"OpenEMR from 7.0.1 before 8.4.0 ignores its one-time-use and access-count flags for service_auth tokens and never revokes consumed tokens. It also checks the login PIN without rate limiting or strict comparison, so an attacker holding a captured token can replay it or guess the PIN to open patient-portal sessions that expose protected health information.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","patient-portal","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attackers open patient portal sessions and read protected health information.","analyst_note":"Confirm the exact affected portal and token configuration and read the vendor advisory at github.com linked in the sources.","how_to_check":"- Check the OpenEMR version: `7.0.1` up to but not including `8.4.0` is affected.\n- Review `src/Common/Auth/OneTimeAuth.php` in your installed copy for the flag handling described.\n- unknown for any other configuration check.","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["version-8.4.0-or-later"],"who_is_affected":"Clinics and organizations running OpenEMR 7.0.1 through 8.3.x with the patient portal and service_auth tokens in use. The sources do not say whether the flaw is reachable without portal or token features enabled, so treat any patient-portal deployment in that version range as exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00079,"input_tokens":4655,"output_tokens":649,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124445':17A,20A '-2026':16A,19A '7.0.1':33B,95C '8.4.0':35B,97C 'access':44B,111C 'access-count':43B 'also':57B 'attack':70B,130C 'auth':49B,118C 'brute':13A,140C 'brute-forc':12A,139C 'captur':73B,133C 'check':58B,121C 'comparison':67B,129C 'consum':54B,116C 'contain':98C 'count':45B,112C 'cve':15A,18A 'enforc':106C 'expos':89B,150C 'flag':46B,113C 'flaw':100C 'forc':14A,141C 'guess':79B 'health':91B 'healthcar':22B 'hold':71B,131C 'host':30B 'ignor':36B,104C 'inform':92B 'limit':64B,126C 'login':5A,60B,122C 'max':110C 'never':52B,114C 'one':3A,39B 'one-tim':2A 'one-time-us':38B 'onetim':107C 'open':83B,145C 'openemr':1A,21A,23B,31B,93C 'patient':25B,85B,147C 'patient-port':24B,84B,146C 'phi':151C 'pin':11A,61B,81B,123C,143C 'portal':26B,86B,148C 'protect':90B 'rate':63B,125C 'replay':9A,76B,136C 'revok':53B,115C 'runtim':27B 'self':29B 'self-host':28B 'servic':48B,117C 'session':87B,149C 'src/common/auth/onetimeauth.php':102C 'strict':66B,128C 'time':4A,40B 'token':6A,50B,55B,74B,119C,134C 'use':41B,108C 'without':62B,124C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations running OpenEMR 7.0.1 through 8.3.x with the patient portal and service_auth tokens in use. The sources do not say whether the flaw is reachable without portal or token features enabled, so treat any patient-portal deployment in that version range as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["critical","healthcare","openemr","patientportal","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124445':17A,20A '-2026':16A,19A 'brute':13A 'brute-forc':12A 'cve':15A,18A 'forc':14A 'login':5A 'one':3A 'one-tim':2A 'openemr':1A,21A 'pin':11A 'replay':9A 'time':4A 'token':6A","search_b":"'7.0.1':33B '8.4.0':35B 'access':44B 'access-count':43B 'also':57B 'attack':70B 'auth':49B 'captur':73B 'check':58B 'comparison':67B 'consum':54B 'count':45B 'expos':89B 'flag':46B 'guess':79B 'health':91B 'healthcar':22B 'hold':71B 'host':30B 'ignor':36B 'inform':92B 'limit':64B 'login':60B 'never':52B 'one':39B 'one-time-us':38B 'open':83B 'openemr':23B,31B 'patient':25B,85B 'patient-port':24B,84B 'pin':61B,81B 'portal':26B,86B 'protect':90B 'rate':63B 'replay':76B 'revok':53B 'runtim':27B 'self':29B 'self-host':28B 'servic':48B 'session':87B 'strict':66B 'time':40B 'token':50B,55B,74B 'use':41B 'without':62B","search_c":"'7.0.1':95C '8.4.0':97C 'access':111C 'attack':130C 'auth':118C 'brute':140C 'brute-forc':139C 'captur':133C 'check':121C 'comparison':129C 'consum':116C 'contain':98C 'count':112C 'enforc':106C 'expos':150C 'flag':113C 'flaw':100C 'forc':141C 'hold':131C 'ignor':104C 'limit':126C 'login':122C 'max':110C 'never':114C 'onetim':107C 'open':145C 'openemr':93C 'patient':147C 'patient-port':146C 'phi':151C 'pin':123C,143C 'portal':148C 'rate':125C 'replay':136C 'revok':115C 'servic':117C 'session':149C 'src/common/auth/onetimeauth.php':102C 'strict':128C 'token':119C,134C 'use':108C 'without':124C","cause_entry":null,"cause_path":null,"first_public_at":"2026-09-13T09:43:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124445","severity":null,"published_at":"2026-11-08T14:18:11+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102074,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:43:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102075,"url":"https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}