CVE-2026-33303 in OpenEMR
Summary
by MITRE • 03/19/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the "Create Portal Login" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability CVE-2026-33303 affects OpenEMR versions prior to 8.0.0.2, representing a critical stored cross-site scripting flaw that enables attackers to execute malicious scripts within the context of clinic staff members' browsers. This vulnerability specifically manifests through the unescaped `portal_login_username` parameter in the portal credential print view functionality. The flaw allows malicious actors to inject XSS payloads through the patient portal user interface, creating a persistent threat that remains active until the affected application is updated. The vulnerability's severity stems from its ability to transition from a patient session context into a staff or administrative session context, effectively enabling privilege escalation through session hijacking techniques.
The technical implementation of this vulnerability occurs when a patient portal user deliberately sets their login username to contain malicious JavaScript code. When clinic staff members subsequently navigate to the "Create Portal Login" page for that patient, the unescaped username value gets rendered in the staff member's browser, executing the stored payload. This represents a classic stored XSS attack pattern where the malicious input is first stored on the server and then executed when other users view the affected content. The vulnerability's exploitation requires minimal user interaction from staff members, as simply opening the portal login creation page triggers the payload execution, making it particularly dangerous in clinical environments where staff members frequently access patient records.
The operational impact of this vulnerability extends beyond simple script execution, as it creates a significant attack surface that could compromise entire clinic systems. Clinic staff members who view affected patient records could have their sessions hijacked, potentially leading to unauthorized access to sensitive medical information, modification of patient data, or even complete system compromise. The vulnerability's ability to cross session contexts means that an attacker could gain access to administrative privileges through a patient portal account, violating fundamental security principles of least privilege and separation of duties. This type of vulnerability directly impacts the integrity and confidentiality of healthcare data, potentially violating regulations such as HIPAA requirements for protecting patient information.
Mitigation strategies for this vulnerability center on updating to OpenEMR version 8.0.0.2 or later, which includes proper input sanitization and output escaping for the `portal_login_username` parameter. Organizations should implement comprehensive patch management procedures to ensure all instances of OpenEMR are updated promptly. Additional defensive measures include implementing content security policies to limit script execution, conducting regular security audits of web applications, and establishing proper input validation for all user-supplied data. The vulnerability demonstrates the importance of proper output escaping techniques, aligning with CWE-79 which addresses cross-site scripting vulnerabilities. From an ATT&CK framework perspective, this vulnerability maps to T1566 (Phishing) and T1071.001 (Application Layer Protocol: Web Protocols) as it enables attackers to leverage web application flaws to execute malicious code in the context of legitimate users.
The broader implications of this vulnerability highlight the critical need for healthcare organizations to maintain robust security practices for medical applications. Patient portal systems represent high-value attack targets due to their direct access to sensitive health information and their typically less restrictive security controls compared to administrative systems. This vulnerability serves as a reminder that even seemingly benign input fields can become attack vectors when proper sanitization techniques are not implemented. Security teams should consider implementing automated vulnerability scanning for web applications, establishing secure coding practices for all development activities, and conducting regular penetration testing to identify similar flaws before they can be exploited in production environments. The fix implemented in version 8.0.0.2 demonstrates the importance of proper input validation and output escaping in preventing XSS attacks, which remains a fundamental security principle in web application development.