Authentication and Authorization Bypass in OpenHealth

OpenHealth versions 0.2.0 and earlier contain a critical missing authentication and authorization vulnerability in the /api/health-data/[id] endpoint. The affected handlers for GET, PATCH, and DELETE operations fail to validate user sessions or verify that the requested HealthData record belongs to the requester. An unauthenticated attacker who discovers or enumerates a valid record identifier can bypass security controls to access, alter, or destroy sensitive patient information. This vulnerability poses a significant risk to the confidentiality and integrity of medical data handled by the application. Because the flaw exists within the core API logic, it is trivial to exploit via standard HTTP requests once a valid record ID is identified.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate private medical record data and metadata, overwrite existing patient records with arbitrary JSON payloads, or delete critical records entirely. This exposes patient health information to unauthorized parties and disrupts the availability of medical records, which may have legal, compliance, and clinical safety implications depending on the deployment environment.

Recommendation

• Upgrade the OpenHealth application to a version released after 0.2.0 that includes patches for authentication enforcement.
• Audit access logs for high volumes of 200 OK responses to GET, PATCH, or DELETE requests targeting /api/health-data/* from unauthenticated or unexpected IP sources.
• Implement strict ingress filtering or network-level authentication (e.g., mTLS or API gateway validation) as a compensating control until the application can be patched.
• Use the webserver logs to monitor for excessive enumerative requests against the /api/health-data/ endpoint, which may indicate an attacker attempting to discover valid record IDs.