CVE-2026-126473

OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization

View on CVE.org
Published Nov 13, 2026 CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Description
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.
Title OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization
First Time appeared Open-emr
Open-emr openemr
Weaknesses CWE-863
CPEs cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
Vendors & Products Open-emr
Open-emr openemr
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 13, 2026, 9:34 AM
Reserved
Nov 10, 2026, 9:42 PM

View source JSON

No data.

No data.

No data.

No data.