OpenEMR (7.0.1 - 8.3.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openemr-7.0.1---8.3.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:28:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenEMR: Authentication bypass and token replay via OneTimeAuth (CVE-2026-124445)https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass/Sun, 08 Nov 2026 15:28:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass/OpenEMR versions 7.0.1 through 8.3.x contain an authentication bypass vulnerability where service_auth tokens are not revoked and PIN verification lacks rate limiting, enabling session hijacking and unauthorized access to PHI.OpenEMR versions from 7.0.1 up to 8.4.0 contain a critical flaw in the src/Common/Auth/OneTimeAuth.php component. The application fails to properly respect enforce_onetime_use and max_access_count flags, resulting in service_auth tokens remaining active after use. Additionally, the login_pin verification process lacks rate limiting and strict comparison, allowing attackers to perform brute-force attacks against the PIN.

Impact

Successful exploitation allows unauthenticated attackers to hijack patient portal sessions by replaying captured tokens or brute-forcing PINs. This results in the unauthorized disclosure of sensitive Protected Health Information (PHI).

Recommendation

  • Upgrade OpenEMR to version 8.4.0 or later immediately.
  • Review web server access logs for anomalous, high-frequency requests directed at the authentication endpoints handled by OneTimeAuth.php to identify potential brute-force attempts.
  • Audit existing authentication tokens and session logs for evidence of token reuse.
]]>criticaladvisory