CVE-2026-126426 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR 5.0.2 before 8.5.0 has a missing authentication check in its MFA registration pages, so anyone holding a logged-in user's session can delete that user's second factors or register their own U2F key. The attacker can then log in with the password alone and bypass MFA.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations between 5.0.2 and 8.5.0 that use MFA. Exposure requires an attacker to already hold an authenticated user session, for example via session hijacking. Installations without MFA enabled are not exposed to the MFA bypass.
Not affected if mfa-not-enabled, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
5.0.2 up to but not including 8.5.0 are listed as affected.mfa_registrations.php and mfa_u2f.php in the OpenEMR web root.8.5.0 or later, per the product ranges.OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.