CVE-2026-124445: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force

Published Nov 8, 2026

Updated

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforceonetimeuse and maxaccesscount flags, never revokes consumed serviceauth tokens, and checks loginpin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

OpenEMR versions from 7.0.1 before 8.4.0 are affected. The vulnerable code is in the OneTimeAuth component used for service_auth tokens and patient-portal session access.

What does an attacker need to exploit this issue?

An attacker can replay a captured service_auth token because consumed tokens are not revoked. They may also brute-force the associated login PIN because attempts are not rate-limited and the PIN comparison is not strict.

Is authentication required before exploitation?

The vulnerability has a network attack vector and requires no privileges or user interaction. However, token replay requires the attacker to possess a captured service_auth token, while PIN brute force targets the login PIN check.

What is the impact of successful exploitation?

Successful exploitation can open patient-portal sessions and expose protected health information. The reported severity vector also indicates potential high impacts to confidentiality, integrity, and availability.

How can I determine whether my instance is vulnerable?

Verify the installed OpenEMR version and assess whether it is 7.0.1 or later but earlier than 8.4.0. Systems in that range should also review whether OneTimeAuth service_auth tokens are used to establish patient-portal sessions.

CVE-2026-124445: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is authentication required before exploitation?

What is the impact of successful exploitation?

How can I determine whether my instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is authentication required before exploitation?

What is the impact of successful exploitation?

How can I determine whether my instance is vulnerable?