Act nowDisclosed

Advisory · CVE-2026-124445

OpenEMR one-time login tokens can be replayed to open patient portal sessions

OpenEMR 7.0.1 before 8.4.0 ignores the enforce_onetime_use and max_access_count flags in OneTimeAuth, never revokes consumed service_auth tokens, and checks login PINs without rate limiting or strict comparison, letting attackers replay a captured token or brute-force the PIN to open patient portal sessions exposing PHI, rated critical at CVSS 9.8; fixed in 8.4.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124445
CWE-307
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR hands out single-use login passes for the patient portal, like a ticket that should tear itself up after one use. The ticket never tears, and the PIN check can be guessed over and over, so anyone holding a used ticket can walk back in and read patient records.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Token captured

    An attacker obtains a service_auth token, for example from logs or a shared link.

  2. 02One-time check skipped

    OneTimeAuth ignores the enforce_onetime_use and max_access_count flags.

  3. 03Token replayed

    The consumed token is presented again and accepted.

  4. 04PIN brute-forced

    The login PIN is guessed without rate limiting or strict comparison.

  5. 05Portal session opened

    A patient portal session opens, exposing protected health information.

What happened

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.

A one-time token that works forever is a permanent credential, and the missing PIN rate limit makes guessing cheap. The flaw is fixed in OpenEMR 8.4.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.4.0 or later.
  3. Invalidate outstanding service_auth tokens and review how they were distributed.
  4. Review portal login logs for token reuse and PIN guessing.
  5. Treat any session opened with a replayed token as a compromise indicator and notify affected patients if PHI access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Patient portal sessions holding PHI were reachable with a used ticket and a guessable PIN. Treat the exposure window as a breach assessment, not just a patch.