PT-2026-139980

CVE-2026-124466

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An issue allows unauthenticated attackers to induce the server to send HTTP requests by registering an OAuth2 client with an unvalidated jwks uri. This can be triggered via the token introspection endpoint using an unsigned client assertion, enabling the probing of internal services and access to cloud metadata endpoints. Server-side request forgery is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 8.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers