CVE-2026-126473 is a critical authorization bypass in OpenEMR before 8.4.0. Flaws in how OpenEMR canonicalizes OAuth scopes and checks scope containment let unauthenticated attackers get unapproved system-level FHIR access to Patient records.
What Is It
The flaw is in how OpenEMR handles OAuth scopes. The NVD description says an attacker can register a client using the colon form of a scope, system:Patient.read, and that client skips approval. The attacker can then request system/Patient.write, a scope that was never registered. With it, they can read, modify and create Patient records through the FHIR interface.
The weakness is classified as CWE-863 (Incorrect Authorization). VulnCheck disclosed it, and NVD published it on 2026-11-13. The NVD status is "Awaiting Analysis."
Why It Matters
VulnCheck rates this flaw critical under both CVSS versions:
- CVSS 3.1: 9.1 (CRITICAL),
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 4.0: 9.3 (CRITICAL)
The attack works over the network with low complexity. It needs no privileges and no user interaction. Confidentiality and integrity impacts are both rated high. In practice, an outside attacker with no account could get write access to patient data in an electronic medical records system. That puts both the privacy and the accuracy of clinical records at risk.
Exploitation status: As of publication, CVE-2026-126473 is not listed in the CISA Known Exploited Vulnerabilities Catalog. KEV does not confirm active exploitation, and there is no KEV-mandated required action or due date.
What's Vulnerable
- Vendor/Product: OpenEMR
- Affected: all versions before 8.4.0
- Not affected: 8.4.0
The NVD record does not list any CPE entries yet.
Patch Status
The affected-version data marks OpenEMR 8.4.0 as unaffected. Organizations running earlier versions should upgrade to 8.4.0 or later and check the vendor's GitHub security advisory for full remediation guidance. The flaw lets attackers register unapproved OAuth clients, so administrators should consider reviewing their registered OAuth clients after patching.