Product
OpenEMR versions 7.0.1 through 8.3.x contain an authentication bypass vulnerability where service_auth tokens are not revoked and PIN verification lacks rate limiting, enabling session hijacking and unauthorized access to PHI.