CVE-2026-126426

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 8.4.x

Description An authentication flaw exists in the 'mfa registrations.php' and 'mfa u2f.php' endpoints. This issue allows an attacker who has hijacked an authenticated session to delete multi-factor authentication (MFA) factors or register new U2F keys without being required to re-enter the password. By removing existing second factors or adding their own U2F key, the attacker can bypass MFA during subsequent login attempts using only the password.

Recommendations Update to version 8.5.0 or later. Restrict access to the 'mfa registrations.php' and 'mfa u2f.php' endpoints as a temporary mitigation.