CVE-2026-67611: OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67611?
The severity of CVE-2026-67611 is rated as high with a score of 8.1.
How do I fix CVE-2026-67611?
To fix CVE-2026-67611, update OpenEMR to version 8.2.1 or later where the vulnerability is addressed.
What type of attack does CVE-2026-67611 enable?
CVE-2026-67611 enables attackers to bypass multi-factor authentication using valid credentials by exploiting an OAuth2 password grant flow.
What versions of software are affected by CVE-2026-67611?
CVE-2026-67611 affects all versions of OpenEMR through 8.2.0.
Is multi-factor authentication compromised in CVE-2026-67611?
Yes, CVE-2026-67611 allows attackers with valid credentials to circumvent multi-factor authentication.