PT-2026-22835 · Openemr · Openemr

Simecek · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-24898

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. A flaw in the MedEx callback endpoint allows unauthenticated access to the practice's MedEx API tokens. This can lead to compromise of third-party services, unauthorized access to Protected Health Information (PHI), and potential HIPAA violations. The issue occurs because the endpoint bypasses authentication and performs a MedEx login when $ POST['callback key'] is provided, returning a JSON response that includes sensitive API tokens. The vulnerable endpoint is '/MedEx/callback'. The vulnerable parameter is callback key.

Recommendations Update to version 8.0.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-24898

GHSA-QWFF-3MW7-7RC7

Affected Products

Openemr

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24898.json · Exploit
• https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24898 · Security Note
• https://twitter.com/VulmonFeeds/status/2029108531719274749 · Twitter Post
• https://twitter.com/CVEnew/status/2028974440176828491 · Twitter Post
• https://t.me/cveNotify/154230 · Telegram Post
• https://t.me/cveNotify/154168 · Telegram Post
• https://twitter.com/CveFindCom/status/2028964002160685173 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029108894665195686 · Twitter Post
• https://t.me/CVEtracker/46243 · Telegram Post