This vulnerability allows an unauthenticated attacker to configure an OAuth2 client with an arbitrary jwks_uri, causing the OpenEMR server to issue HTTP requests to any destination specified by the attacker. The flaw permits the attacker to reach internal services and cloud metadata endpoints via the token introspection endpoint, potentially exposing sensitive configuration data, enabling lateral movement, and providing a foothold for further exploitation. The weakness is a classic SSRF reflected through unvalidated input, categorized as CWE‑918.

The vulnerability affects the OpenEMR application for all versions released prior to 8.4.0. No specific service packs or sub‑versions are listed as mitigated; use the version information supplied by the vendor for confirmation.

The CVSS base score of 6.9 indicates a medium severity risk. With no EPSS score available, the current exploitation probability is unknown but could be non‑negligible given the lack of defensive controls. The software is not listed in the CISA KEV catalog. The attack vector is inferred to be internal network access over HTTP, delegated through the unauthenticated client registration flow. Publicly available references suggest that exploitation has been demonstrated in a proof‑of‑concept context, reinforcing the need for timely action.