CVE-2026-103019

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The userSessionLogout() function in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id token hint without verifying its signature. If the referenced trusted session is missing, the application redirects to the post logout redirect uri provided by the caller before validating it against the registered client redirect URIs. This allows an unauthenticated attacker to create a logout link that invalidates a user session and redirects the user to an arbitrary external site, facilitating phishing attacks. This issue is accessible when the OpenEMR REST API is enabled.

Recommendations Update to version 8.3.0.