CVE-2026-25146: OpenEMR's payments gateway_api_key secret rendered into client JS code
OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25146?
CVE-2026-25146 is considered a high-severity vulnerability due to the exposure of sensitive API keys in client-side code.
How do I fix CVE-2026-25146?
To fix CVE-2026-25146, you should upgrade OpenEMR to version 8.0.0 or later where the issue is resolved.
What versions of OpenEMR are affected by CVE-2026-25146?
CVE-2026-25146 affects OpenEMR versions from 5.0.2 up to but not including 8.0.0.
What risk does CVE-2026-25146 pose to OpenEMR users?
CVE-2026-25146 poses a risk of unauthorized access to payment processing by exposing the gateway_api_key to clients.
Is there a workaround for CVE-2026-25146 if I cannot update immediately?
There are no documented workarounds for CVE-2026-25146; the recommended action is to upgrade to a patched version as soon as possible.