CVE-2026-67611

Katalog CVE

CVSS 8.1 · High EPSS 0,78%

Kerentanan Use of Single-factor Authentication pada open-emr openemr. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-308: Use of Single-factor Authentication

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jivasecurity.com/writeups/openemr-preauth-disclosure-password-grant exploit · mitigasi · advisory pihak ketiga
• https://www.vulncheck.com/advisories/openemr-oauth2-password-grant-authentication-bypass-via-smart-configurati... exploit · advisory pihak ketiga · mitigasi