CVE-2026-126427 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR's Eye Exam form polls the server every 15 seconds in a way that resets the idle session timer, so automatic logoff never fires. Anyone who reaches an unattended logged-in workstation can view patient health information.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and practices running OpenEMR before 8.5.0 where staff leave workstations logged in with the Eye Exam form open. Sites that do not use the Eye Exam form, or that enforce physical access controls and short logins, face less exposure.
Not affected if no-eye-exam-form-use, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
version.php and compare it with the fixed version below.8.5.0 or later.OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds.
This page as .md · .json · CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.