OpenEMR versions through 8.2.0 expose an unauthenticated client registration endpoint that permits anyone to create an OAuth2 client and immediately request a password grant token using valid user credentials. This flow circumvents the normal web interface authentication process and all configured multi‑factor authentication controls, allowing the attacker to obtain an API access token that has the same privileges as the legitimate user. The vulnerability is a classic example of improper authentication flow and is classified as CWE‑308: Improper Verification of Cryptographic Signature.

The affected product is OpenEMR, specifically all releases up to and including 8.2.0. Users installing or running these versions are at risk, while later releases that patch the unauthenticated client registration endpoint are not affected.

The CVSS score of 8.6 places this flaw in the high‑severity range. The EPSS score is currently unavailable, so the current exploitation probability remains unknown, but the absence of a KEV listing does not negate the risk. Based on the description, an attacker requires valid user credentials to execute the bypass; once a client is registered, the password grant can be used to harvest an OAuth2 access token. The attack tends to occur over exposed network interfaces that permit registration, so restricting endpoint exposure or requiring authentication for client creation would greatly reduce exploitability.