PT-2026-22835 · Openemr · Openemr

Simecek

·

Publicado

2026-03-03

·

Atualizado

2026-03-04

·

CVE-2026-24898

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0
Description OpenEMR is an electronic health records and medical practice management application. A flaw in the MedEx callback endpoint allows unauthenticated access to the practice's MedEx API tokens. This can lead to compromise of third-party services, unauthorized access to Protected Health Information (PHI), and potential HIPAA violations. The issue occurs because the endpoint bypasses authentication and performs a MedEx login when $ POST['callback key'] is provided, returning a JSON response that includes sensitive API tokens. The vulnerable endpoint is '/MedEx/callback'. The vulnerable parameter is callback key.
Recommendations Update to version 8.0.0 or later.

Exploit

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-24898
GHSA-QWFF-3MW7-7RC7

Produtos afetados

Openemr