7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
Not on CISA's list of exploited flaws, and not in the news we track.
0.35%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124445. Nothing runs until you send it.
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.