CVE-2026-67610: OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the clientcredentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67610?
CVE-2026-67610 has a severity score of 8.1, which is classified as high.
How does CVE-2026-67610 affect OpenEMR?
CVE-2026-67610 allows unauthenticated attackers to register malicious clients with system-level FHIR scopes in OpenEMR.
What systems are impacted by CVE-2026-67610?
CVE-2026-67610 affects OpenEMR versions up to 8.2.0.
How can I mitigate the risks associated with CVE-2026-67610?
To mitigate CVE-2026-67610, it is advised to upgrade to the latest version of OpenEMR that addresses this vulnerability.
What authentication issue is present in CVE-2026-67610?
CVE-2026-67610 involves an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint.