PT-2026-37002 · Openemr · Openemr

Abhhi · Published 2026-05-05 · Updated 2026-05-05 · CVE-2023-54347

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR version 7.0.1

Description An authentication brute force issue allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests using the authUser and clearPass parameters to systematically test username and password combinations without triggering account lockout restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-54347

Affected Products

Openemr

References · 6

• 🔥 https://exploit-db.com/exploits/51413 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54347 · Security Note
• https://github.com/openemr/openemr/archive/refs/tags/v7_0_1.tar.gz · Note
• https://open-emr.org · Note
• https://vulncheck.com/advisories/openemr-authentication-brute-force-mitigation-bypass · Note
• https://t.me/cveNotify/162160 · Telegram Post