CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass (CWE-308) that lets an attacker who already has a user's valid username and password log in without satisfying multi-factor authentication. The attacker registers an OAuth2 client via OpenEMR's unauthenticated client registration endpoint, then uses the exposed OAuth2 password grant to exchange those credentials directly for an API access token, bypassing the normal web login flow where MFA is enforced. With the resulting token, the attacker gains authenticated API access to the OpenEMR instance with high confidentiality and integrity impact per the CVSS score, even in deployments that require MFA on the web interface. Any OpenEMR deployment at version 8.2.0 or earlier with the OAuth2/API features enabled is affected. No in-the-wild exploitation is confirmed so far; two public technical writeups/PoCs exist, EPSS is 0.5% (43rd percentile), and the issue is not in CISA KEV.

What to do: Upgrade OpenEMR to a patched release newer than 8.2.0 per the vendor/VulnCheck advisories (no specific fixed version is given in the available data). Until patched, disable or restrict the unauthenticated OAuth2 client registration endpoint and the password grant, review registered OAuth2 clients for unexpected entries, and monitor for API access tokens issued without MFA. Because exploitation requires valid credentials, prioritize environments where MFA is the primary defense against stolen or phished credentials.