{"id":"CVE-2026-124466","kind":"vulnerability","aliases":["CVE-2026-124466"],"related":[],"title":"OpenEMR: unauthenticated server-side request forgery via OAuth2 jwks_uri","description":"OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.","summary":"OpenEMR before 8.4.0 lets anyone register an OAuth2 client with an unvalidated jwks_uri, then make the server fetch that URL through the token introspection endpoint. An attacker can use the server to probe internal services and reach cloud metadata endpoints.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloud","oauth2","openemr","other","self-hosted"],"not_affected_if":["no-oauth2-endpoints-exposed","version-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; a version below `8.4.0` is in the affected range.\n- Confirm whether OAuth2 client registration is reachable from the internet on your OpenEMR instance.","fix":"- OpenEMR: move to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:14+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:25+00:00","updated_at":"2026-11-08T14:49:25+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:49:25Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later.","reach":"internet","title":"OpenEMR: unauthenticated server-side request forgery via OAuth2 jwks_uri","impact":"medium","summary":"OpenEMR before 8.4.0 lets anyone register an OAuth2 client with an unvalidated jwks_uri, then make the server fetch that URL through the token introspection endpoint. An attacker can use the server to probe internal services and reach cloud metadata endpoints.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","oauth2","cloud"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server reaches internal services and cloud metadata credentials.","analyst_note":"Confirm whether OAuth2 client registration is enabled by default and read the vendor advisory on github.com for the exact fixed version and any workaround.","how_to_check":"- Check the OpenEMR version in the installed application; a version below `8.4.0` is in the affected range.\n- Confirm whether OAuth2 client registration is reachable from the internet on your OpenEMR instance.","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["version-8.4.0-or-later","no-oauth2-endpoints-exposed"],"who_is_affected":"Any OpenEMR deployment before 8.4.0 that exposes its OAuth2 endpoints is exposed, since the flaw needs no account. Hosts that run OpenEMR on cloud infrastructure with metadata endpoints are the most sensitive, as the server can reach internal addresses on the attacker's behalf.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4627,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124466':14A,17A '-2026':13A,16A '8.4.0':28B,69C 'allow':79C 'anyon':30B 'assert':113C 'attack':53B,81C,99C 'client':34B,93C,112C 'cloud':19B,64B,120C 'contain':70C 'cve':12A,15A 'endpoint':51B,66B,108C,122C 'fetch':44B,103C 'forgeri':7A,76C 'host':25B 'http':87C 'intern':60B,116C 'introspect':50B,107C 'jwks':10A,38B,97C 'let':29B 'make':41B,83C 'metadata':65B,121C 'oauth2':9A,20B,33B,92C 'openemr':1A,18A,21B,26B,67C 'probe':59B,115C 'reach':63B,119C 'regist':31B,90C 'request':6A,75C,88C 'self':24B 'self-host':23B 'send':86C 'server':4A,43B,57B,73C,85C 'server-sid':3A,72C 'servic':61B,117C 'side':5A,74C 'token':49B,106C 'trigger':101C 'unauthent':2A,80C 'unsign':111C 'unvalid':37B,96C 'uri':11A,39B,98C 'url':46B 'use':55B 'via':8A,104C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.4.0 that exposes its OAuth2 endpoints is exposed, since the flaw needs no account. Hosts that run OpenEMR on cloud infrastructure with metadata endpoints are the most sensitive, as the server can reach internal addresses on the attacker's behalf.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["cloud","high","oauth2","openemr","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124466':14A,17A '-2026':13A,16A 'cve':12A,15A 'forgeri':7A 'jwks':10A 'oauth2':9A 'openemr':1A,18A 'request':6A 'server':4A 'server-sid':3A 'side':5A 'unauthent':2A 'uri':11A 'via':8A","search_b":"'8.4.0':28B 'anyon':30B 'attack':53B 'client':34B 'cloud':19B,64B 'endpoint':51B,66B 'fetch':44B 'host':25B 'intern':60B 'introspect':50B 'jwks':38B 'let':29B 'make':41B 'metadata':65B 'oauth2':20B,33B 'openemr':21B,26B 'probe':59B 'reach':63B 'regist':31B 'self':24B 'self-host':23B 'server':43B,57B 'servic':61B 'token':49B 'unvalid':37B 'uri':39B 'url':46B 'use':55B","search_c":"'8.4.0':69C 'allow':79C 'assert':113C 'attack':81C,99C 'client':93C,112C 'cloud':120C 'contain':70C 'endpoint':108C,122C 'fetch':103C 'forgeri':76C 'http':87C 'intern':116C 'introspect':107C 'jwks':97C 'make':83C 'metadata':121C 'oauth2':92C 'openemr':67C 'probe':115C 'reach':119C 'regist':90C 'request':75C,88C 'send':86C 'server':73C,85C 'server-sid':72C 'servic':117C 'side':74C 'token':106C 'trigger':101C 'unauthent':80C 'unsign':111C 'unvalid':96C 'uri':98C 'via':104C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:41:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124466","severity":null,"published_at":"2026-11-08T14:18:14+00:00","modified_at":"2026-11-08T14:18:14+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102117,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-mf6h-xc62-9fg4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:41:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102118,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-unauthenticated-ssrf-via-oauth2-client-jwks-uri","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}