CVE-2026-126473
CRITICAL
NVD
CVSS Score
9.1
Severity
CRITICAL
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.