{"id":"CVE-2026-126426","kind":"vulnerability","aliases":["CVE-2026-126426"],"related":[],"title":"OpenEMR: missing authentication lets session holders change MFA factors","description":"OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.","summary":"OpenEMR 5.0.2 before 8.5.0 has a missing authentication check in its MFA registration pages, so anyone holding a logged-in user's session can delete that user's second factors or register their own U2F key. The attacker can then log in with the password alone and bypass MFA.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["mfa-not-enabled","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions from `5.0.2` up to but not including `8.5.0` are listed as affected.\n- Look for `mfa_registrations.php` and `mfa_u2f.php` in the OpenEMR web root.","fix":"- OpenEMR: upgrade to `8.5.0` or later, per the product ranges.","status":"open","published_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:57:15+00:00","updated_at":"2026-11-13T10:57:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:57:15Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later, per the product ranges.","reach":"network","title":"OpenEMR: missing authentication lets session holders change MFA factors","impact":"medium","summary":"OpenEMR 5.0.2 before 8.5.0 has a missing authentication check in its MFA registration pages, so anyone holding a logged-in user's session can delete that user's second factors or register their own U2F key. The attacker can then log in with the password alone and bypass MFA.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker removes MFA factors and bypasses second-factor login checks","analyst_note":"Ensure fix version details are confirmed against the vendor advisory.}","how_to_check":"- Check the OpenEMR version in the installed application; versions from `5.0.2` up to but not including `8.5.0` are listed as affected.\n- Look for `mfa_registrations.php` and `mfa_u2f.php` in the OpenEMR web root.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","mfa-not-enabled"],"who_is_affected":"OpenEMR installations between 5.0.2 and 8.5.0 that use MFA. Exposure requires an attacker to already hold an authenticated user session, for example via session hijacking. Installations without MFA enabled are not exposed to the MFA bypass.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4653,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126426':12A,15A '-2026':11A,14A '5.0.2':24B,74C '8.5.0':26B,76C 'add':116C 'allow':87C 'alon':69B 'anyon':38B 'attack':61B,103C 'authent':3A,30B,80C,108C 'bypass':71B,121C 'chang':7A 'check':31B 'contain':77C 'cve':10A,13A 'delet':48B,91C 'entri':102C 'factor':9A,53B,93C,114C 'healthcar':16B 'hijack':89C 'hold':39B,104C 'holder':6A 'host':22B 'key':59B,97C,120C 'later':124C 'let':4A 'log':42B,64B 'logged-in':41B 'login':125C 'mfa':8A,34B,72B,92C,122C 'mfa_registrations.php':83C 'mfa_u2f.php':85C 'miss':2A,29B,79C 'openemr':1A,17B,23B,73C 'packag':18B 'page':36B 'password':68B,99C,128C 'php':19B 're':101C 're-entri':100C 'regist':55B,95C 'registr':35B 'remov':111C 'second':52B,113C 'self':21B 'self-host':20B 'session':5A,46B,88C,109C 'u2f':58B,96C,119C 'user':44B,50B 'victim':106C 'vulner':81C 'without':98C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations between 5.0.2 and 8.5.0 that use MFA. Exposure requires an attacker to already hold an authenticated user session, for example via session hijacking. Installations without MFA enabled are not exposed to the MFA bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126426':12A,15A '-2026':11A,14A 'authent':3A 'chang':7A 'cve':10A,13A 'factor':9A 'holder':6A 'let':4A 'mfa':8A 'miss':2A 'openemr':1A 'session':5A","search_b":"'5.0.2':24B '8.5.0':26B 'alon':69B 'anyon':38B 'attack':61B 'authent':30B 'bypass':71B 'check':31B 'delet':48B 'factor':53B 'healthcar':16B 'hold':39B 'host':22B 'key':59B 'log':42B,64B 'logged-in':41B 'mfa':34B,72B 'miss':29B 'openemr':17B,23B 'packag':18B 'page':36B 'password':68B 'php':19B 'regist':55B 'registr':35B 'second':52B 'self':21B 'self-host':20B 'session':46B 'u2f':58B 'user':44B,50B","search_c":"'5.0.2':74C '8.5.0':76C 'add':116C 'allow':87C 'attack':103C 'authent':80C,108C 'bypass':121C 'contain':77C 'delet':91C 'entri':102C 'factor':93C,114C 'hijack':89C 'hold':104C 'key':97C,120C 'later':124C 'login':125C 'mfa':92C,122C 'mfa_registrations.php':83C 'mfa_u2f.php':85C 'miss':79C 'openemr':73C 'password':99C,128C 're':101C 're-entri':100C 'regist':95C 'remov':111C 'second':113C 'session':88C,109C 'u2f':96C,119C 'victim':106C 'vulner':81C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:18:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126426","severity":null,"published_at":"2026-11-13T10:17:48+00:00","modified_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145095,"url":"https://github.com/openemr/openemr/commit/e0dee295497bba763151913bde563a826c739cd7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145096,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:18:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145097,"url":"https://www.vulncheck.com/advisories/openemr-5.0.2-before-8.5.0-missing-re-authentication-for-mfa-factor-deletion-and-u2f-registration","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}