CVE-2026-24898: OpenEMR has an Unauthenticated MedEx Token Disclosure
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $POST['callbackkey'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24898?
CVE-2026-24898 is classified as a medium severity vulnerability due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2026-24898?
To fix CVE-2026-24898, upgrade OpenEMR to version 8.0.0 or later, where this vulnerability is patched.
What type of vulnerability is CVE-2026-24898?
CVE-2026-24898 is an unauthenticated token disclosure vulnerability affecting the MedEx callback endpoint in OpenEMR.
Who is affected by CVE-2026-24898?
Anyone using OpenEMR versions prior to 8.0.0 is affected by CVE-2026-24898.
What can happen if CVE-2026-24898 is exploited?
Exploitation of CVE-2026-24898 allows unauthorized visitors to obtain sensitive MedEx tokens, compromising the security of confidential data.