OpenEMR versions 6.0.0‑8.3.0 allow an unauthenticated actor to supply a login parameter to interface/globals.php before authentication completes. The application uses this value to populate an intermediate user ID variable and load that account’s user_settings, which may result in additional database queries and visible customized settings for existing usernames. Existing usernames can be distinguished from nonexistent ones, giving attackers a timing or content‑difference vector to enumerate valid accounts and enabling subsequent credential‑guessing attacks. The weakness can be classified as a lack of proper authentication enforcement (CWE‑200), insufficient input validation (CWE‑203), and information disclosure through user-specific data (CWE‑208).

The affected product is OpenEMR, an electronic health record and medical practice management application. All releases from version 6.0.0 through 8.2.9 are impacted; the issue was resolved in release 8.3.0.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, suggesting the exploitation probability has not been quantified yet. The vulnerability is not listed in CISA's KEV catalog. Attacks require no authentication and can be performed remotely by submitting crafted login requests and observing response differences, making it feasible for attackers to enumerate usernames and then potentially target them with credential‑guessing or social‑engineering attacks. The impact remains confined to information disclosure and potential credential compromise, but given the sensitivity of health data, the risk to confidentiality and integrity is significant.