CVE-2026-124466: OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

Published Nov 8, 2026

Updated

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned clientassertion to probe internal services and reach cloud metadata endpoints.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

OpenEMR versions before 8.4.0 are affected. The issue is reachable remotely over the network and does not require authentication or user interaction.

What does an attacker need to exploit this issue?

An attacker needs to register an OAuth2 client with a jwks_uri that is not validated, then trigger retrieval through the token introspection endpoint using an unsigned client_assertion. This can cause the OpenEMR server to issue HTTP requests to attacker-selected destinations.

What systems could an attacker reach through the vulnerable server?

The vulnerability can be used to probe internal services reachable from the OpenEMR server and to access cloud metadata endpoints. The provided information does not identify additional network restrictions or affected endpoint types.

How can I determine whether my instance is vulnerable?

Check the deployed OpenEMR version: instances before 8.4.0 are affected. Also review whether OAuth2 client registration permits jwks_uri values without validation and whether the token introspection endpoint is exposed.

CVE-2026-124466: OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What systems could an attacker reach through the vulnerable server?

How can I determine whether my instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What systems could an attacker reach through the vulnerable server?

How can I determine whether my instance is vulnerable?