CVE-2026-126436: OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint
OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauthclients.granttypes is never enforced. Attackers can request tokens with granttype=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected where the OAuth2 token endpoint is available. The issue concerns enforcement of grant types configured for OAuth2 clients.
What does an attacker need to exploit the grant-type bypass?
An attacker can request a token using grant_type=password when that grant type is not registered for the OAuth2 client, bypassing the user consent screen. Exploiting the disabled-client case requires an authorization code and a JWT client assertion.
Are disabled OAuth2 clients protected from token redemption?
No. A disabled client can still redeem authorization codes when using JWT client assertions.
How can I determine whether my instance is vulnerable?
Check whether the OpenEMR version is earlier than 8.5.0. On affected versions, OAuth2 clients may obtain tokens through unregistered grant types because the oauth_clients.grant_types setting is not enforced.