CVE-2026-126426
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in OpenEMR via Session Hijacking

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126426
EUVD
EUVD-2026-125017

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)
openemr openemr to 8.4.1 (inc)
openemr openemr to 8.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR 5.0.2 before 8.5.0 has a missing authentication flaw in mfa_registrations.php and mfa_u2f.php. Session hijackers can delete multi-factor authentication (MFA) factors or register U2F keys without re-entering the password. Attackers with a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA during future logins with just the password.

Detection Guidance

Check OpenEMR versions below 8.5.0 for vulnerable files mfa_registrations.php and mfa_u2f.php. Review server logs for unauthorized access to these files or unusual MFA factor deletions.

Impact Analysis

If exploited, attackers can bypass MFA protections, gaining unauthorized access to accounts even if MFA is enabled. This could lead to data breaches, unauthorized modifications, or complete account takeover if combined with other vulnerabilities.

Compliance Impact

This vulnerability could violate compliance requirements that mandate MFA for access control, such as GDPR's security principles or HIPAA's access controls. Failure to protect MFA integrity may result in non-compliance penalties or legal consequences.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Review and revoke any suspicious sessions or MFA registrations. Implement additional monitoring for unauthorized changes to MFA settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...