OpenEMR 7.0.1 allows attackers to bypass authentication rate limiting by repeatedly sending POST requests to the login endpoint, enabling systematic brute‑force testing of username and password combinations without account lockout. This vulnerability, classified as CWE‑307, provides attackers with a feasible path to compromise credentials and gain unauthorized access to the application. The impact is a direct breach of authentication controls, potentially resulting in full system access for the attacker.

The vulnerability is present only in OpenEMR version 7.0.1. Users running this specific release are exposed, while later releases beginning with 7.0.2 do not contain the reported flaw.

The CVSS score of 8.7 signifies a high severity vulnerability that can be exploited over the network. With the loss of rate limiting and account lockout, attackers can launch automated credential‑guessing campaigns against the exposed login interface; the EPSS score is not available, but the lack of KEV listing does not diminish the risk of exploitation for publicly accessible deployments. Attackers require network access to the main login endpoint and the ability to submit repeated POST requests.