OpenEMR versions 7.0.1 through 8.3.x contain a flaw in the OneTimeAuth module that ignores configuration flags that are meant to enforce one‑time token usage and set maximum access counts. The flaw also permits an attacker to use a captured service_auth token repeatedly, and to attempt PIN entries without any rate limiting or strict comparison, allowing brute‑force attacks on the patient‑portal PIN. An attacker who has access to a token can thus re‑open patient‑portal sessions and expose protected health information.

The vulnerability affects OpenEMR deployments running any release between 7.0.1 and 8.3.x inclusive. All installations of these versions that enable the patient‑portal or OneTimeAuth features are susceptible. The official CNA states that versions prior to 8.4.0 are affected.

The CVSS score of 9.3 indicates a high‑severity risk. Although the EPSS score is not available, the nature of the flaw—unauthorized session reuse and brute‑forceable PINs—suggests a plausible exploitation window, especially in environments where tokens are transmitted unencrypted or stored insecurely. The vulnerability is not listed in the CISA KEV catalog, but the severity and potential for PHI exposure warrant immediate remediation. Attackers would need to first capture or guess a valid service_auth token, then replay it or brute‑force the PIN; no special privileges beyond the captured token are required.