OpenEMR: Authentication bypass and token replay via OneTimeAuth (CVE-2026-124445)
OpenEMR versions 7.0.1 through 8.3.x contain an authentication bypass vulnerability where service_auth tokens are not revoked and PIN verification lacks rate limiting, enabling session hijacking and unauthorized access to PHI.
CVE search metadata
CVE search record: CVE-2026-124445. Severity: critical. CVSS: 9.8. KEV: no. Product: OpenEMR (7.0.1 - 8.3.x). Brief: OpenEMR: Authentication bypass and token replay via OneTimeAuth (CVE-2026-124445). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass/
Triage facts
Revision 1- Applicability
- OpenEMR (7.0.1 - 8.3.x)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
OpenEMR versions from 7.0.1 up to 8.4.0 contain a critical flaw in the src/Common/Auth/OneTimeAuth.php component. The application fails to properly respect enforce_onetime_use and max_access_count flags, resulting in service_auth tokens remaining active after use. Additionally, the login_pin verification process lacks rate limiting and strict comparison, allowing attackers to perform brute-force attacks against the PIN.
Impact
Successful exploitation allows unauthenticated attackers to hijack patient portal sessions by replaying captured tokens or brute-forcing PINs. This results in the unauthorized disclosure of sensitive Protected Health Information (PHI).
Recommendation
- Upgrade OpenEMR to version 8.4.0 or later immediately.
- Review web server access logs for anomalous, high-frequency requests directed at the authentication endpoints handled by
OneTimeAuth.phpto identify potential brute-force attempts. - Audit existing authentication tokens and session logs for evidence of token reuse.
Immediate actions
Upgrade OpenEMR to 8.4.0 or later to patch CVE-2026-124445
Threat Hunt
Identify high-frequency POST requests to patient portal authentication endpoints
Data: Web server access logs (cs-method, cs-uri-stem, sc-status)