CVE-2026-67610 in OpenEMR
Summary
by MITRE • 08/03/2026
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the OpenEMR healthcare information system version 8.2.0 and earlier, where an improper authentication flaw has been identified in the OAuth2 dynamic client registration endpoint. The weakness stems from insufficient validation of client registration requests, specifically allowing attackers to submit malicious client registrations without proper authentication. This occurs through the jwks field which accepts self-generated RSA keypairs, enabling unauthorized parties to create client applications with elevated privileges.
The technical implementation flaw permits unauthenticated attackers to register OAuth2 clients with system-level FHIR scopes that grant comprehensive access to all patient data within the system. When administrators approve these malicious registrations, the compromised system allows attackers to leverage the client_credentials grant type combined with self-signed JWT assertions to obtain valid access tokens. These tokens provide read access to all FHIR resources across every patient in the database, representing a critical privilege escalation vulnerability.
The operational impact of this vulnerability is severe for healthcare organizations utilizing OpenEMR systems, as it enables attackers to gain complete read access to sensitive patient medical records and health information. The vulnerability affects the core authentication and authorization mechanisms within the system's FHIR implementation, potentially exposing thousands of patient records to unauthorized access. This represents a direct violation of healthcare data protection requirements and could result in significant regulatory penalties under HIPAA and similar privacy frameworks.
The weakness aligns with CWE-287 which addresses improper authentication issues in software systems, specifically targeting authentication bypass scenarios. From an attacker perspective, this vulnerability maps to techniques described in the MITRE ATT&CK framework under T1078 Valid Accounts and T1566 Phishing, as it allows attackers to establish persistent access through legitimate OAuth2 mechanisms. The vulnerability also demonstrates characteristics of privilege escalation attacks where initial unauthorized access leads to system-level privileges.
Organizations should immediately apply security patches provided by OpenEMR maintainers and implement additional controls such as monitoring for unusual client registration patterns in the OAuth2 system. Administrators should review all existing client registrations and revoke any suspicious entries, while implementing stricter validation requirements for client registration requests. Network segmentation and access controls should be strengthened to limit administrative access to OAuth2 endpoints, and comprehensive logging should be enabled to detect unauthorized client registration activities. Regular security assessments of authentication mechanisms and FHIR API implementations are essential to prevent similar vulnerabilities from emerging in healthcare systems.