CVE-2026-126426: OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfaregistrations.php and mfau2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.0
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs control of a victim's already authenticated OpenEMR session. The issue does not describe exploitation without an authenticated session.
Which deployments are affected?
OpenEMR versions from 5.0.2 before 8.5.0 are affected. The vulnerable functionality involves MFA factor deletion and U2F key registration.
What could an attacker do after obtaining a session?
They could delete the victim's MFA factors or register a U2F key under their control without re-entering the password. This can let them bypass MFA during later logins if they also have the victim's password.