CVE-2026-126473

OpenEMR authorization bypass in OAuth scope checks

critical · 9.3

Fix listed

OpenEMR

Published Nov 13, 2026, 09:34 UTC

Description

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

Reported fixed versions

8.4.0

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.