CVE-2026-126473: OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenEMR versions before 8.4.0 are affected. The issue concerns OAuth client registration and system-level FHIR access, including access to Patient records.
What does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. An attacker can register a client using the colon-form system:Patient.read scope and then request the unregistered system/Patient.write scope.
What access can exploitation provide?
The bypass can grant unapproved system-level FHIR access. An attacker can read, modify, and create Patient records.
Is there a documented workaround if upgrading is not immediately possible?
No workaround or mitigation is provided in the available information. The stated affected range is OpenEMR versions before 8.4.0.