CVE-2026-126091: iDentalSoft website information exposure
Published Nov 13, 2026
·Updated
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
Affected Software
1 affected component
iDentalSoft iDentalSoft<14.0.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iDentalSoftto a version that resolves this vulnerability.Fixed in 14.0.3
Event History
Nov 13, 2026
CVE Published
via MITRE·05:11 PM
Data Sourced
via MITRE·05:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can access the exposed information?
Any user who loads the affected pages can receive the JSON response. Exploitation requires no authentication or user interaction and can be performed remotely over the network.
2
What types of data may be exposed?
The exposed JSON can include OAuth credentials, password hashes, and personally identifiable information (PII).
3
Which version addresses the issue?
The issue is fixed in iDentalSoft 14.0.3.