PT-2026-22836 · Openemr · Openemr

Firehed · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-25146

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.2 through 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Versions between 5.0.2 and before 8.0.0 have paths where the gateway api key secret value is rendered to the client in plaintext. Exposure of these secret keys could lead to unauthorized money movement or account takeover of payment gateway APIs. The gateway api key is a sensitive variable used for accessing payment gateway APIs.

Recommendations Update to OpenEMR version 8.0.0.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-25146

GHSA-2HQ8-WC73-JVVQ

Affected Products

Openemr

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25146.json · Exploit
• https://github.com/openemr/openemr/commit/fe6341496dc82d5b4f5a3f35891bb2e2481f3b25 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-2hq8-wc73-jvvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25146 · Security Note
• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/portal/portal_payment.php#L537 · Note
• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/interface/patient_file/front_payment.php#L765 · Note
• https://twitter.com/infoflowcloud/status/2028975432163369270 · Twitter Post
• https://twitter.com/CVEnew/status/2028974441045078302 · Twitter Post
• https://t.me/cveNotify/154169 · Telegram Post
• https://twitter.com/CveFindCom/status/2028964049216557099 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029105971994267709 · Twitter Post
• https://t.me/cveNotify/154223 · Telegram Post
• https://t.me/CVEtracker/46244 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029108943667229177 · Twitter Post