Technical impact
The vulnerability allows an attacker to register a malicious OAuth2 client without authentication. By supplying a self‑generated RSA key pair in the jwks field, the attacker obtains a client with system‑level FHIR scopes. After an administrator approves the client, the attacker can use the client_credentials grant with a self‑signed JWT to acquire access tokens that permit reading every FHIR resource for all patients. This results in full data exfiltration potential, compromising patient confidentiality and violating privacy regulations.
Affected Systems
OpenEMR version 8.2.0 and earlier are affected. Any installation that uses the default OAuth2 dynamic client registration endpoint and accepts self‑generated key material without strict authentication is vulnerable. The problem is tied to the OpenEMR application, not specific operating system platforms.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity, but the EPSS score is not available, suggesting we lack recent exploitation data. The vulnerability is not listed in CISA KEV, so it has not yet been confirmed as widely exploited in the wild. An attacker can exploit it remotely by sending unauthenticated requests to the registration endpoint; no special privileges are required before administrative approval. Once the client is approved, payloads can be sent over the network to obtain read tokens, providing unrestricted access to sensitive healthcare information.
