CVE-2026-124445 is a critical (CVSS 3.1 9.8) authentication flaw in OpenEMR from 7.0.1 up to but not including 8.4.0. Attackers can replay captured service_auth tokens or brute-force login PINs to open patient-portal sessions that expose protected health information (PHI).
What Is It
The flaw is in src/Common/Auth/OneTimeAuth.php. According to the NVD record, the one-time authentication logic:
- ignores the
enforce_onetime_useandmax_access_countflags - never revokes service_auth tokens after they are used
- checks
login_pinwith no rate limiting and no strict comparison
An attacker who holds a captured token can therefore reuse it, or brute-force the PIN, to open patient-portal sessions. The weakness is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts).
Why It Matters
OpenEMR stores medical records, and the NVD description says successful exploitation exposes PHI through patient-portal sessions. VulnCheck, the CNA, scored it:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack works over the network, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. - CVSS 4.0: 9.3 CRITICAL.
Exploitation status: CVE-2026-124445 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation has not been confirmed. The CVSS 4.0 exploit maturity field in the NVD record is "Not Defined."
What's Vulnerable
- Vendor/Product: OpenEMR
- Affected: version 7.0.1 up to but not including 8.4.0 (semver)
- Unaffected: 8.4.0
The NVD record lists no CPE entries. Its status is "Received," published 2026-11-08.
Patch Status
The affected-version data marks OpenEMR 8.4.0 as unaffected, which means upgrading to 8.4.0 or later is the remediation. The CVE has no entry in the CISA KEV catalog, so no CISA required action or due date applies. Organizations running OpenEMR 7.0.1 through any release before 8.4.0 should read the vendor's GitHub security advisory and upgrade. Patient portals exposed to the internet should be the first priority.