OpenEMR up to 8.3.x OneTimeAuth OneTimeAuth.php authentication replay

Summaryinfo

A vulnerability identified as critical has been detected in OpenEMR up to 8.3.x. This affects an unknown part of the file src/Common/Auth/OneTimeAuth.php of the component OneTimeAuth. Performing a manipulation results in authentication replay. This vulnerability is cataloged as CVE-2026-124445. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in OpenEMR up to 8.3.x. This affects some unknown functionality of the file src/Common/Auth/OneTimeAuth.php of the component OneTimeAuth. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-124445 since 11/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

By approaching the search of inurl:src/Common/Auth/OneTimeAuth.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.4.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 8.0
• 8.1
• 8.2
• 8.3

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion