CVE-2026-124445Critical· 9.8▾ MidnightOpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.
openemr >= 7.0.1 < 8.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124444High· 7.1OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
CVE-2026-124446High· 8.8OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
CVE-2026-124456High· 7.1OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
CVE-2026-124447High· 8.1OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
CVE-2026-124452Medium· 5.4OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
CVE-2026-124466High· 7.2OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri