CVE-2026-126427: OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form
OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since updateREADONLY() resets the idle timer every 15 seconds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Organizations using OpenEMR before 8.5.0 are exposed where a user leaves a workstation unattended with an active session and the Eye Exam form is open in read-only mode. A person with physical access to that workstation could use the session to view patient health information.
What access does an attacker need to exploit it?
The attacker needs physical access to an unattended workstation that still has an active OpenEMR session. The issue does not describe a remote exploitation path.
Are idle sessions affected automatically?
The affected Eye Exam form read-only polling behavior resets the idle timer every 15 seconds, preventing the expected automatic logoff. This occurs because the poll omits skip_timeout_reset.
What can be done before upgrading?
Ensure users manually log off and lock or secure workstations whenever they are unattended, particularly when the Eye Exam form is open in read-only mode. Restrict physical access to logged-in clinical workstations.