CVE-2026-126436 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 does not enforce the grant types registered for each OAuth2 client, so a client can request tokens with grant_type=password and bypass the user consent screen. Disabled clients can also redeem authorization codes using JWT client assertions.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations that expose the OAuth2 or API endpoints to clients are affected, since the flaw lies in how those endpoints enforce grant types and client status. Deployments with no OAuth2 clients registered or with the API not exposed are likely not reachable through this path, but the sources do not say this explicitly.
Not affected if api-not-exposed, oauth2-disabled
Who cares healthcare, oauth2, openemr
8.5.0 are named as affected.8.5.0 or later (per the NVD description).OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.