{"id":"CVE-2026-124445","published":"2026-11-08T14:18:11.487","lastModified":"2026-11-10T21:46:29.570","description":"OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-307"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR versions before 8.4.0 fail to enforce one-time use and access limits on service_auth tokens, allowing token replay, and also lack rate limiting and constant-time comparison for login_pin validation, enabling brute-force attacks on patient portal sessions. This exposes protected health information (PHI) by letting attackers reuse stolen tokens or guess PINs indefinitely.","exploitability":"Exploitation is straightforward for attackers with a captured service_auth token or network visibility to capture tokens; no authentication or special privileges are required beyond initial token acquisition.","blast_radius":"Successful exploitation grants unauthorized access to patient portal sessions, potentially exposing sensitive PHI of all patients using the portal across the affected instance.","remediation":"Upgrade to OpenEMR 8.4.0 or later, which fixes the token reuse flaw and adds rate limiting and constant-time comparison for login_pin validation.","detection":"Defenders should monitor for repeated successful authentications using the same service_auth token in logs (e.g., multiple 'service_auth' entries with identical value across sessions), and for excessive failed login_pin attempts from a single IP or session in authentication logs. No reliable network-level indicator is derivable from the published description.","tags":["token-replay","brute-force","auth-bypass","webapp","phidataleak"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:43:35.795Z"}}