{"id":"CVE-2026-126436","kind":"vulnerability","aliases":["CVE-2026-126436"],"related":[],"title":"OpenEMR: OAuth2 clients skip grant-type checks and consent screen","description":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.","summary":"OpenEMR before 8.5.0 does not enforce the grant types registered for each OAuth2 client, so a client can request tokens with grant_type=password and bypass the user consent screen. Disabled clients can also redeem authorization codes using JWT client assertions.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","oauth2","openemr","other"],"not_affected_if":["api-not-exposed","oauth2-disabled"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are named as affected.","fix":"- OpenEMR: move to `8.5.0` or later (per the NVD description).","status":"open","published_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","triaged_at":"2026-11-13T10:50:18+00:00","updated_at":"2026-11-13T10:50:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:50:18Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (per the NVD description).","reach":"internet","title":"OpenEMR: OAuth2 clients skip grant-type checks and consent screen","impact":"high","summary":"OpenEMR before 8.5.0 does not enforce the grant types registered for each OAuth2 client, so a client can request tokens with grant_type=password and bypass the user consent screen. Disabled clients can also redeem authorization codes using JWT client assertions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","oauth2","healthcare"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker obtains access tokens and bypasses user consent","analyst_note":"Confirm the affected endpoints and whether the consent bypass needs a registered client; check the vendor advisory on github.com and the VulnCheck page for how_to_check and exposure details.","how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are named as affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["oauth2-disabled","api-not-exposed"],"who_is_affected":"OpenEMR installations that expose the OAuth2 or API endpoints to clients are affected, since the flaw lies in how those endpoints enforce grant types and client status. Deployments with no OAuth2 clients registered or with the API not exposed are likely not reachable through this path, but the sources do not say this explicitly.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4617,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126436':14A,17A '-2026':13A,16A '8.5.0':23B,64C 'allow':71C 'also':54B 'assert':61B,109C 'attack':85C 'author':56B,67C,104C 'bypass':46B,68C,94C 'check':8A 'client':3A,34B,37B,52B,60B,73C,101C,108C 'code':57B,105C 'consent':10A,49B,97C 'contain':65C 'cve':12A,15A 'disabl':51B,100C 'enforc':26B,84C 'grant':6A,28B,42B,77C,90C 'grant-typ':5A 'healthcar':18B 'jwt':59B,107C 'never':83C 'oauth2':2A,19B,33B,72C 'oauth_clients.grant':80C 'openemr':1A,20B,21B,62C 'password':44B,92C 'redeem':55B,103C 'regist':30B 'request':39B,87C 'screen':11A,50B,98C 'skip':4A 'token':40B,88C 'type':7A,29B,43B,78C,81C,91C 'unregist':76C 'use':58B,75C,106C 'user':48B,96C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations that expose the OAuth2 or API endpoints to clients are affected, since the flaw lies in how those endpoints enforce grant types and client status. Deployments with no OAuth2 clients registered or with the API not exposed are likely not reachable through this path, but the sources do not say this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","oauth2","openemr","other"],"campaign_type":null,"search_a":"'-126436':14A,17A '-2026':13A,16A 'check':8A 'client':3A 'consent':10A 'cve':12A,15A 'grant':6A 'grant-typ':5A 'oauth2':2A 'openemr':1A 'screen':11A 'skip':4A 'type':7A","search_b":"'8.5.0':23B 'also':54B 'assert':61B 'author':56B 'bypass':46B 'client':34B,37B,52B,60B 'code':57B 'consent':49B 'disabl':51B 'enforc':26B 'grant':28B,42B 'healthcar':18B 'jwt':59B 'oauth2':19B,33B 'openemr':20B,21B 'password':44B 'redeem':55B 'regist':30B 'request':39B 'screen':50B 'token':40B 'type':29B,43B 'use':58B 'user':48B","search_c":"'8.5.0':64C 'allow':71C 'assert':109C 'attack':85C 'author':67C,104C 'bypass':68C,94C 'client':73C,101C,108C 'code':105C 'consent':97C 'contain':65C 'disabl':100C 'enforc':84C 'grant':77C,90C 'jwt':107C 'never':83C 'oauth2':72C 'oauth_clients.grant':80C 'openemr':62C 'password':92C 'redeem':103C 'request':87C 'screen':98C 'token':88C 'type':78C,81C,91C 'unregist':76C 'use':75C,106C 'user':96C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:34:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126436","severity":null,"published_at":"2026-11-13T10:17:50+00:00","modified_at":"2026-11-13T10:17:50+00:00","first_seen_at":"2026-11-13T10:47:22+00:00","fetched_at":"2026-11-13T10:47:22+00:00","note":null}],"documents":[{"id":145116,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qjj7-c4m9-6f92","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:34:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145117,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-oauth2-grant-type-enforcement-bypass-via-token-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}