{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openemr-7.0.1---8.3.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-124445"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (7.0.1 - 8.3.x)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions from 7.0.1 up to 8.4.0 contain a critical flaw in the \u003ccode\u003esrc/Common/Auth/OneTimeAuth.php\u003c/code\u003e component. The application fails to properly respect \u003ccode\u003eenforce_onetime_use\u003c/code\u003e and \u003ccode\u003emax_access_count\u003c/code\u003e flags, resulting in service_auth tokens remaining active after use. Additionally, the \u003ccode\u003elogin_pin\u003c/code\u003e verification process lacks rate limiting and strict comparison, allowing attackers to perform brute-force attacks against the PIN.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to hijack patient portal sessions by replaying captured tokens or brute-forcing PINs. This results in the unauthorized disclosure of sensitive Protected Health Information (PHI).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.4.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-frequency requests directed at the authentication endpoints handled by \u003ccode\u003eOneTimeAuth.php\u003c/code\u003e to identify potential brute-force attempts.\u003c/li\u003e\n\u003cli\u003eAudit existing authentication tokens and session logs for evidence of token reuse.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:28:53Z","date_published":"2026-11-08T15:28:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass/","summary":"OpenEMR versions 7.0.1 through 8.3.x contain an authentication bypass vulnerability where service_auth tokens are not revoked and PIN verification lacks rate limiting, enabling session hijacking and unauthorized access to PHI.","title":"OpenEMR: Authentication bypass and token replay via OneTimeAuth (CVE-2026-124445)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenEMR (7.0.1 - 8.3.x)","version":"https://jsonfeed.org/version/1.1"}