---
id: CVE-2026-124445
title: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
summary: >-
  OpenEMR from 7.0.1 before 8.4.0 contains a flaw in
  src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and
  max_access_count flags, never revokes consumed service_auth tokens, and checks
  login_pin without rate limiting or…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-307
vendor: openemr
product: openemr
affected:
  - openemr >= 7.0.1 < 8.4.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:37.304Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124445'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6'
    label: GitHub Security Advisory (GHSA-xg3m-9pfq-c8r6)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force
    label: >-
      VulnCheck Advisory: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay
      and PIN Brute Force
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.978Z'
---

## Overview

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.

## Affected

- `openemr >= 7.0.1 < 8.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.