CVE-2026-126454

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description Lack of rate limiting or lockout mechanisms during Time-based One-Time Password (TOTP) submission allows an attacker who possesses a valid password to brute-force the 6-digit multi-factor authentication (MFA) code. This can be achieved by scripting repeated POST requests to the 'main screen.php' endpoint or through the OAuth2 authorization flow by re-submitting hidden credentials to bypass two-factor authentication.

Recommendations Update to version 8.5.0 or later.