OpenEMR: Server-side request forgery in OAuth2 client registration (CVE-2026-124466)

OpenEMR versions before 8.4.0 are susceptible to a server-side request forgery (SSRF) vulnerability. The flaw exists within the OAuth2 client registration mechanism, where an unvalidated jwks_uri can be registered. An unauthenticated attacker can subsequently invoke the token introspection endpoint using an unsigned client_assertion, forcing the OpenEMR server to initiate HTTP requests to arbitrary destinations. This can be used to perform internal network reconnaissance or access sensitive cloud metadata services.

Impact

Successful exploitation allows unauthenticated attackers to interact with internal-only services or cloud metadata endpoints (e.g., 169.254.169.254) from the perspective of the vulnerable server, potentially leading to unauthorized data access or credential exfiltration.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later immediately.
• Audit OAuth2 client registration logs for suspicious jwks_uri entries pointing to unexpected domains or internal IP ranges.
• Restrict the server's egress traffic via network security groups to prevent unauthorized outbound connections to internal service endpoints or cloud metadata services.