{"id":"CVE-2026-126473","kind":"vulnerability","aliases":["CVE-2026-126473"],"related":[],"title":"OpenEMR: OAuth scope flaws let anonymous users write patient records","description":"OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.","summary":"OpenEMR before 8.4.0 mishandles OAuth scope names, so an unauthenticated attacker can register a client that gets system-level FHIR access without approval. That access lets the attacker read, modify and create Patient records.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fhir","healthcare","openemr","runtime","self-hosted"],"not_affected_if":["openemr-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; the sources say versions before `8.4.0` are affected\n- Confirm whether dynamic client registration is reachable from the internet on your OpenEMR instance","fix":"- OpenEMR: move to `8.4.0` or later","status":"open","published_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","triaged_at":"2026-11-13T10:48:22+00:00","updated_at":"2026-11-13T10:48:22+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later","reach":"internet","title":"OpenEMR: OAuth scope flaws let anonymous users write patient records","impact":"high","summary":"OpenEMR before 8.4.0 mishandles OAuth scope names, so an unauthenticated attacker can register a client that gets system-level FHIR access without approval. That access lets the attacker read, modify and create Patient records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","fhir","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads, changes and creates patient health records","analyst_note":"Confirm default OAuth client registration settings and whether the FHIR API is enabled by default, using the vendor advisory on github.com.","how_to_check":"- Check the OpenEMR version in the installed application; the sources say versions before `8.4.0` are affected\n- Confirm whether dynamic client registration is reachable from the internet on your OpenEMR instance","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.4.0-or-later"],"who_is_affected":"Organisations running OpenEMR before 8.4.0 that expose its OAuth and FHIR API endpoints. The sources do not say whether instances that restrict client registration or keep the FHIR API off the internet are exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4615,"output_tokens":535,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126473':13A,16A '-2026':12A,15A '8.4.0':26B,61C 'access':45B,49B,80C 'allow':70C 'anonym':6A 'approv':47B,93C 'attack':34B,52B,72C,81C 'bypass':92C 'canonic':65C 'client':38B,90C 'colon':86C 'colon-form':85C 'contain':62C,67C 'creat':56B,103C 'cve':11A,14A 'fhir':17B,44B,79C 'flaw':4A,68C 'form':87C 'get':40B 'healthcar':18B 'host':23B 'let':5A,50B 'level':43B,78C 'mishandl':27B 'modifi':54B,101C 'name':30B 'oauth':2A,28B,63C 'obtain':74C 'openemr':1A,19B,24B,59C 'patient':9A,57B,104C 'patient.read':89C 'read':53B,100C 'record':10A,58B,105C 'regist':36B,83C 'request':95C 'runtim':20B 'scope':3A,29B,64C,98C 'self':22B 'self-host':21B 'system':42B,77C,88C 'system-level':41B,76C 'system/patient.write':97C 'unapprov':75C 'unauthent':33B,71C 'unregist':96C 'user':7A 'without':46B 'write':8A","nicknames":[],"mitigations":[],"who_affected":"Organisations running OpenEMR before 8.4.0 that expose its OAuth and FHIR API endpoints. The sources do not say whether instances that restrict client registration or keep the FHIR API off the internet are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","fhir","healthcare","openemr","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126473':13A,16A '-2026':12A,15A 'anonym':6A 'cve':11A,14A 'flaw':4A 'let':5A 'oauth':2A 'openemr':1A 'patient':9A 'record':10A 'scope':3A 'user':7A 'write':8A","search_b":"'8.4.0':26B 'access':45B,49B 'approv':47B 'attack':34B,52B 'client':38B 'creat':56B 'fhir':17B,44B 'get':40B 'healthcar':18B 'host':23B 'let':50B 'level':43B 'mishandl':27B 'modifi':54B 'name':30B 'oauth':28B 'openemr':19B,24B 'patient':57B 'read':53B 'record':58B 'regist':36B 'runtim':20B 'scope':29B 'self':22B 'self-host':21B 'system':42B 'system-level':41B 'unauthent':33B 'without':46B","search_c":"'8.4.0':61C 'access':80C 'allow':70C 'approv':93C 'attack':72C,81C 'bypass':92C 'canonic':65C 'client':90C 'colon':86C 'colon-form':85C 'contain':62C,67C 'creat':103C 'fhir':79C 'flaw':68C 'form':87C 'level':78C 'modifi':101C 'oauth':63C 'obtain':74C 'openemr':59C 'patient':104C 'patient.read':89C 'read':100C 'record':105C 'regist':83C 'request':95C 'scope':64C,98C 'system':77C,88C 'system-level':76C 'system/patient.write':97C 'unapprov':75C 'unauthent':71C 'unregist':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:15:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126473","severity":null,"published_at":"2026-11-13T10:17:56+00:00","modified_at":"2026-11-13T10:17:56+00:00","first_seen_at":"2026-11-13T10:47:25+00:00","fetched_at":"2026-11-13T10:47:25+00:00","note":null}],"documents":[{"id":145189,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6xh3-fmm5-jjp4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:15:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145190,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-oauth-authorization-bypass-via-scope-canonicalization","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}