CVE-2026-126473
Awaiting Analysis Awaiting Analysis - Queue

OAuth Scope Flaw in OpenEMR Allows Unauthorized FHIR Access

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126473
EUVD
EUVD-2026-124951

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR versions before 8.4.0 have flaws in OAuth scope handling that let unauthenticated attackers bypass approval and gain unauthorized FHIR access. Attackers can register a client with a colon-form system:Patient.read scope to access Patient records without permission, then request system/Patient.write scope to read, modify, or create records.

Impact Analysis

If you use OpenEMR before 8.4.0, attackers could steal, alter, or delete sensitive patient data, including medical records. This could lead to privacy breaches, incorrect treatments, or legal consequences for healthcare providers.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to patient data. GDPR requires strict data protection, and HIPAA mandates safeguards for health information. Exploits could result in non-compliance, fines, or legal penalties.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later to address the OAuth scope flaws. Review and restrict FHIR API access permissions to prevent unauthorized system-level operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126473. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...