CVE-2026-124445

Summary

OpenEMR versions before 8.4.0 fail to enforce one-time use and access limits on service_auth tokens, allowing token replay, and also lack rate limiting and constant-time comparison for login_pin validation, enabling brute-force attacks on patient portal sessions. This exposes protected health information (PHI) by letting attackers reuse stolen tokens or guess PINs indefinitely.

Exploitability

Exploitation is straightforward for attackers with a captured service_auth token or network visibility to capture tokens; no authentication or special privileges are required beyond initial token acquisition.

Blast radius

Successful exploitation grants unauthorized access to patient portal sessions, potentially exposing sensitive PHI of all patients using the portal across the affected instance.

Detection

Defenders should monitor for repeated successful authentications using the same service_auth token in logs (e.g., multiple 'service_auth' entries with identical value across sessions), and for excessive failed login_pin attempts from a single IP or session in authentication logs. No reliable network-level indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenEMR 8.4.0 or later, which fixes the token reuse flaw and adds rate limiting and constant-time comparison for login_pin validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.