CVE-2026-67611

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.2.1

Description An authentication bypass exists that allows users with valid credentials to circumvent multi-factor authentication. This is achieved by exploiting the OAuth2 password grant flow via an unauthenticated client registration endpoint. An attacker can register an OAuth2 client through this endpoint and use the password grant to exchange credentials for an API access token, thereby bypassing the standard web interface authentication and enforced multi-factor authentication controls.

Recommendations Update to a version newer than 8.2.0.