{"id":"CVE-2026-126091","kind":"vulnerability","aliases":["CVE-2026-126091"],"related":[],"title":"iDentalSoft: dental practice sites leak credentials and patient data in JSON","description":"Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.","summary":"Dental practice websites hosted with iDentalSoft return a JSON response to any visitor who loads certain pages. That response contains OAuth credentials, password hashes and personal information.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dental-practice-sites","healthcare","identalsoft","vendor"],"not_affected_if":["not-identalsoft-hosted"],"how_to_check":"- Check whether the practice site runs iDentalSoft and which version it is on, as stated by the vendor.\n- Load the affected pages without logging in and look for a JSON response containing credentials or personal data.","fix":"- iDentalSoft `14.0.3`","status":"open","published_at":"2026-11-13T18:17:32+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:24+00:00","updated_at":"2026-11-13T18:51:24+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T18:51:24Z","model":"claude-haiku-5-5","output":{"fix":"- iDentalSoft `14.0.3`","reach":"internet","title":"iDentalSoft: dental practice sites leak credentials and patient data in JSON","impact":"high","summary":"Dental practice websites hosted with iDentalSoft return a JSON response to any visitor who loads certain pages. That response contains OAuth credentials, password hashes and personal information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["identalsoft","dental-practice-sites","healthcare"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Visitors read OAuth credentials, password hashes and personal data","analyst_note":"Confirm the affected page paths and whether 14.0.3 is the only fixed version; the NVD record is the only source given.","how_to_check":"- Check whether the practice site runs iDentalSoft and which version it is on, as stated by the vendor.\n- Load the affected pages without logging in and look for a JSON response containing credentials or personal data.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-identalsoft-hosted"],"who_is_affected":"Dental practices whose websites are hosted with iDentalSoft. The sources say the exposure happens to any user who loads certain pages, so no login is needed to trigger it. Sites not hosted by iDentalSoft are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4531,"output_tokens":516,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126091':14A,17A '-2026':13A,16A '14.0.3':82C 'certain':40B,67C 'contain':44B,69C 'credenti':6A,46B,74C 'cve':12A,15A 'data':9A 'dental':2A,19B,25B,52C 'dental-practice-sit':18B 'fix':79C 'hash':48B,76C 'healthcar':22B 'host':28B,55C 'identalsoft':1A,23B,30B,57C,81C 'includ':72C 'inform':51B,71C 'json':11A,33B,60C 'leak':5A 'load':39B,66C 'oauth':45B,73C 'page':41B,68C 'password':47B,75C 'patient':8A 'person':50B 'pii':78C 'practic':3A,20B,26B,53C 'respons':34B,43B,61C 'return':31B 'send':58C 'sensit':70C 'site':4A,21B,54C 'user':64C 'vendor':24B 'visitor':37B 'websit':27B","nicknames":[],"mitigations":[],"who_affected":"Dental practices whose websites are hosted with iDentalSoft. The sources say the exposure happens to any user who loads certain pages, so no login is needed to trigger it. Sites not hosted by iDentalSoft are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dentalpracticesites","healthcare","high","identalsoft","vendor"],"campaign_type":null,"search_a":"'-126091':14A,17A '-2026':13A,16A 'credenti':6A 'cve':12A,15A 'data':9A 'dental':2A 'identalsoft':1A 'json':11A 'leak':5A 'patient':8A 'practic':3A 'site':4A","search_b":"'certain':40B 'contain':44B 'credenti':46B 'dental':19B,25B 'dental-practice-sit':18B 'hash':48B 'healthcar':22B 'host':28B 'identalsoft':23B,30B 'inform':51B 'json':33B 'load':39B 'oauth':45B 'page':41B 'password':47B 'person':50B 'practic':20B,26B 'respons':34B,43B 'return':31B 'site':21B 'vendor':24B 'visitor':37B 'websit':27B","search_c":"'14.0.3':82C 'certain':67C 'contain':69C 'credenti':74C 'dental':52C 'fix':79C 'hash':76C 'host':55C 'identalsoft':57C,81C 'includ':72C 'inform':71C 'json':60C 'load':66C 'oauth':73C 'page':68C 'password':75C 'pii':78C 'practic':53C 'respons':61C 'send':58C 'sensit':70C 'site':54C 'user':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126091","severity":null,"published_at":"2026-11-13T18:17:32+00:00","modified_at":"2026-11-13T18:17:32+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}