CVE-2026-103021: OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Which deployments are affected?
OpenEMR versions from 6.0.0 up to, but not including, 8.3.0 are affected. Version 8.3.0 fixes the issue.
What does an attacker need to exploit this issue?
An attacker only needs remote access to the login interface and does not need authentication or user interaction. They can submit candidate usernames and compare timing or visible page differences.
What information can be obtained?
The issue can reveal whether a username exists. It does not directly disclose credentials, but confirmed usernames can support later credential attacks.
How can I tell whether my deployment may be vulnerable?
Check the deployed OpenEMR version. Systems running 6.0.0 through versions before 8.3.0 may load account-specific user settings before authentication when a submitted login name corresponds to an existing account.