The flaw allows any unauthenticated user to trigger a MedEx login via the callback endpoint by supplying a callback_key parameter, and because authentication is intentionally bypassed the resulting JSON response contains the full MedEx API token set. With these tokens an attacker can compromise the MedEx service, extract protected health information, and perform unauthorized actions, constituting a severe breach of HIPAA.

Any installation of OpenEMR older than version 8.0.0 that exposes the MedEx callback endpoint is affected, including all OpenEMR instances listed under the openemr vendor in the CNA and CPE entries.

The vulnerability carries a CVSS base score of 10, the maximum severity, but its EPSS score of less than 1% indicates that exploitation is not currently widespread and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and remote, requiring only a simple HTTP POST to the endpoint, making exploitation trivial if the application is reachable.