The affected code checks for the presence of the query parameter skip_timeout_reset; if present, the session expiration logic is skipped. This permits any request that includes skip_timeout_reset=1 to bypass the normal timeout and keep an expired session alive. An attacker in possession of a session cookie can repeatedly add this parameter to requests and continue to read or modify protected data indefinitely, and unattended workstations remain logged in.

OpenEMR products prior to version 8.0.0 are vulnerable. The issue was present in all releases before the 8.x line, and the fix is included starting with OpenEMR 8.0.0.

The CVSS score of 7.5 indicates a high severity, yet the EPSS score of less than 1% suggests exploitation is currently unlikely. Because the flaw relies on a controllable HTTP request parameter, a remote attacker who has obtained a session cookie can exploit it from any location, regardless of network segmentation. As the vulnerability is not listed in the CISA KEV catalog, there are no known large‑scale exploits yet, but the potential for data leakage remains significant.