One-Time Authentication Bypass in OpenEMR

Executive Summary

CVE-2026-124445 is a critical authentication bypass flaw in OpenEMR versions 7.0.1 to 8.3.9. It involves three issues: tokens can be replayed indefinitely despite security flags being ignored, 6-digit PINs can be brute-forced without rate limiting, and PIN validation uses loose comparison allowing bypasses. Attackers can capture tokens or PINs to gain unauthorized access to patient-portal sessions and expose PHI.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR logs for repeated token usage or failed PIN attempts. Monitor for unauthorized patient-portal sessions or PHI access outside normal patterns. Review OneTimeAuth.php for missing enforcement of enforce_onetime_use and max_access_count flags.

Useful 0 Not Useful 0

Impact Analysis

Attackers can replay captured tokens or brute-force PINs to access patient-portal sessions, exposing protected health information (PHI) such as names, dates of birth, SSNs, and medical records. Exploits may occur via email interception or log leakage, with potential access lasting up to 14 days in certain scenarios.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access to PHI and failure to implement required safeguards. GDPR compliance may also be impacted as it involves unauthorized processing of personal data. Organizations using affected OpenEMR versions risk significant regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later. Enforce enforce_onetime_use and max_access_count flags. Implement strict PIN comparison and rate limiting for login_pin. Shorten token lifetimes and revoke used tokens immediately.

Useful 0 Not Useful 0