CVE-2026-126454 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 does not rate-limit or lock out submissions of the 6-digit TOTP two-factor code. An attacker who already has a valid password can script repeated requests and guess the code to get past two-factor authentication.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 that uses TOTP two-factor authentication is exposed, since the flaw is in the TOTP submission path. An attacker needs a valid username and password first, so the risk is highest where passwords are weak or leaked. Installations already on 8.5.0 or later are not affected.
Not affected if no-mfa-enabled, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted, totp-mfa
8.5.0 are listed as affected.8.5.0 or later.OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.