CVE-2026-124445

Name of the Vulnerable Software and Affected Versions OpenEMR versions 7.0.1 through 8.3.x

Description A flaw exists in the src/Common/Auth/OneTimeAuth.php file where the system ignores the enforce onetime use and max access count flags. Additionally, the system fails to revoke consumed service auth tokens and performs checks on the login pin without rate limiting or strict comparison. This allows an attacker with a captured token to replay it or brute-force the PIN to gain unauthorized access to patient-portal sessions, potentially exposing Protected Health Information (PHI).

Recommendations Update OpenEMR to version 8.4.0 or later.