{"id":"CVE-2026-126427","kind":"vulnerability","aliases":["CVE-2026-126427"],"related":[],"title":"OpenEMR: idle sessions never time out, exposing patient records on unattended screens","description":"OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds.","summary":"OpenEMR's Eye Exam form polls the server every 15 seconds in a way that resets the idle session timer, so automatic logoff never fires. Anyone who reaches an unattended logged-in workstation can view patient health information.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","runtime","self-hosted"],"not_affected_if":["no-eye-exam-form-use","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the admin footer or `version.php` and compare it with the fixed version below.\n- Open the Eye Exam form and confirm whether the session still stays active while the screen is left idle.","fix":"- OpenEMR: upgrade to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:58:48+00:00","updated_at":"2026-11-13T10:58:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:58:48Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later.","reach":"local","title":"OpenEMR: idle sessions never time out, exposing patient records on unattended screens","impact":"medium","summary":"OpenEMR's Eye Exam form polls the server every 15 seconds in a way that resets the idle session timer, so automatic logoff never fires. Anyone who reaches an unattended logged-in workstation can view patient health information.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Patient health records readable from an unattended logged-in session","analyst_note":"Product ranges and products list not supplied; ecosystem and product name left empty.","how_to_check":"- Check the OpenEMR version in the admin footer or `version.php` and compare it with the fixed version below.\n- Open the Eye Exam form and confirm whether the session still stays active while the screen is left idle.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-eye-exam-form-use"],"who_is_affected":"Clinics and practices running OpenEMR before 8.5.0 where staff leave workstations logged in with the Eye Exam form open. Sites that do not use the Eye Exam form, or that enforce physical access controls and short logins, face less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4616,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126427':15A,18A '-2026':14A,17A '15':34B,118C '8.5.0':66C 'access':93C 'activ':103C 'anyon':50B 'attack':90C 'automat':46B,74C 'contain':67C 'cve':13A,16A 'everi':33B,117C 'exam':28B,79C 'expir':70C 'expos':7A 'eye':27B,78C 'fire':49B 'form':29B,80C 'health':62B,108C 'healthcar':19B 'host':24B 'idl':2A,42B,115C 'inform':63B,109C 'log':56B 'logged-in':55B 'logoff':47B,75C 'never':4A,48B 'omit':86C 'openemr':1A,20B,25B,64C 'patient':8A,61B,107C 'physic':92C 'poll':30B,85C 'prevent':73C 'reach':52B 'read':83C 'read-on':82C 'readon':112C 'record':9A 'reset':40B,89C,113C 'runtim':21B 'screen':12A 'second':35B,119C 'self':23B 'self-host':22B 'server':32B 'session':3A,43B,69C,104C 'sinc':110C 'skip':87C 'still':102C 'still-act':101C 'time':5A 'timeout':88C 'timer':44B,116C 'unattend':11A,54B,96C 'updat':111C 'use':99C 'view':60B,106C 'vulner':71C 'way':38B 'workstat':58B,97C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices running OpenEMR before 8.5.0 where staff leave workstations logged in with the Eye Exam form open. Sites that do not use the Eye Exam form, or that enforce physical access controls and short logins, face less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126427':15A,18A '-2026':14A,17A 'cve':13A,16A 'expos':7A 'idl':2A 'never':4A 'openemr':1A 'patient':8A 'record':9A 'screen':12A 'session':3A 'time':5A 'unattend':11A","search_b":"'15':34B 'anyon':50B 'automat':46B 'everi':33B 'exam':28B 'eye':27B 'fire':49B 'form':29B 'health':62B 'healthcar':19B 'host':24B 'idl':42B 'inform':63B 'log':56B 'logged-in':55B 'logoff':47B 'never':48B 'openemr':20B,25B 'patient':61B 'poll':30B 'reach':52B 'reset':40B 'runtim':21B 'second':35B 'self':23B 'self-host':22B 'server':32B 'session':43B 'timer':44B 'unattend':54B 'view':60B 'way':38B 'workstat':58B","search_c":"'15':118C '8.5.0':66C 'access':93C 'activ':103C 'attack':90C 'automat':74C 'contain':67C 'everi':117C 'exam':79C 'expir':70C 'eye':78C 'form':80C 'health':108C 'idl':115C 'inform':109C 'logoff':75C 'omit':86C 'openemr':64C 'patient':107C 'physic':92C 'poll':85C 'prevent':73C 'read':83C 'read-on':82C 'readon':112C 'reset':89C,113C 'second':119C 'session':69C,104C 'sinc':110C 'skip':87C 'still':102C 'still-act':101C 'timeout':88C 'timer':116C 'unattend':96C 'updat':111C 'use':99C 'view':106C 'vulner':71C 'workstat':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:50:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126427","severity":null,"published_at":"2026-11-13T10:17:49+00:00","modified_at":"2026-11-13T10:17:49+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145098,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:50:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145099,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}