HIGH

CVE-2026-67611

Open-emr Openemr 2026-08-03 CVSS v3.1

CVSS

8.1

Description

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.

Weakness (CWE)

CWE-308

EPSS Score

0.53%

Probability of exploitation in next 30 days

43.7th percentile

References

https://jivasecurity.com/writeups/openemr-preauth-disclosure-password-grant Exploit, Mitigation, Third Party Advisory https://www.vulncheck.com/advisories/openemr-oauth2-password-grant-authentication-bypass-via-smart-configuration Exploit, Third Party Advisory, Mitigation

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE