OPENEMR · CVE-2026-124466 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 lets anyone register an OAuth2 client with an unvalidated jwks_uri, then make the server fetch that URL through the token introspection endpoint. An attacker can use the server to probe internal services and reach cloud metadata endpoints.
first public Sep 13, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any OpenEMR deployment before 8.4.0 that exposes its OAuth2 endpoints is exposed, since the flaw needs no account. Hosts that run OpenEMR on cloud infrastructure with metadata endpoints are the most sensitive, as the server can reach internal addresses on the attacker's behalf.
Not affected if no-oauth2-endpoints-exposed, version-8.4.0-or-later
Who cares cloud, oauth2, openemr, self-hosted
8.4.0 is in the affected range.8.4.0 or later.OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.