CVE-2026-126454: OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2
OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to mainscreen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already possess a valid OpenEMR username and password. They can then repeatedly submit guessed six-digit TOTP codes without user interaction.
Which authentication paths are affected?
The affected TOTP verification can be reached through POST requests to main_screen.php and through the OAuth2 authorization flow, including by re-submitting hidden credentials.
Are systems without MFA affected?
The described attack targets TOTP-based multi-factor authentication. The provided information does not indicate an impact on deployments that do not use TOTP.
What versions need attention?
OpenEMR versions before 8.5.0 are affected. Upgrade to 8.5.0 or later to address the missing TOTP rate limiting or lockout behavior.