CVE-2026-124445
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.