CVE-2026-126436
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in OpenEMR via Unregistered OAuth2 Grant Types

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126436
EUVD
EUVD-2026-125007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has an authorization bypass flaw in its OAuth2 implementation. The system allows OAuth2 clients to use grant types not registered in the oauth_clients.grant_types field. Attackers can exploit this by requesting tokens with grant_type=password to bypass user consent screens. Additionally, disabled clients can redeem authorization codes using JWT client assertions.

Detection Guidance

Check OpenEMR versions before 8.5.0 for OAuth2 misconfigurations. Review oauth_clients.grant_types enforcement in token requests. Look for unauthorized grant_type=password token requests or JWT client assertions from disabled clients.

Impact Analysis

This vulnerability allows unauthorized access to OpenEMR systems. Attackers could gain access without user consent, potentially leading to data breaches, unauthorized data modification, or other malicious activities. Systems using OpenEMR versions before 8.5.0 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating compliance requirements for GDPR and HIPAA. GDPR requires strict access controls and user consent, while HIPAA mandates safeguards for protected health information. Exploitation could result in non-compliance penalties.

Mitigation Strategies

Upgrade to OpenEMR 8.5.0 or later. Disable the password grant type in OAuth2 clients. Revoke tokens for disabled clients. Ensure grant types are enforced during registration and token requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...