It affects releases from 7.0.1 through versions before 8.4.0, which is the patched release.The vulnerable patient portal component fails to enforce stored one-time-use and access-count policies. It also checks an optional PIN without application-level attempt limits or strict comparison.
What it allows
How Does CVE-2026-124445 Enable Token Replay?
An attacker must first obtain a valid service authentication token. The vulnerable component accepts that token again because successful use does not revoke it or enforce its configured access limit.
When a PIN protects the token, the application lacks attempt throttling and lockout. Its non-strict comparison also permits equivalent numeric forms in limited circumstances.
A successful replay or PIN guess can establish a patient portal session. The OpenEMR advisory says this may expose sensitive patient information and permit patient-facing portal actions.
Who is affected
OpenEMR versions from 7.0.1 through releases before 8.4.0 are affected. The vendor advisory lists every version before 8.4.0 as affected and identifies 8.4.0 as patched.
Exposure depends on an attacker obtaining a still-valid service authentication token. Risk is higher where those tokens remain valid longer or where external controls do not restrict repeated authentication attempts.
What to do
-
Upgrade OpenEMR to version 8.4.0 or later
Prioritize installations that expose the patient portal. Confirm the running version after deployment and verify that the update completed across every application node.
-
Invalidate outstanding service authentication tokens
Brandefense recommends invalidating existing one-time service tokens after upgrading where operationally possible. Issue replacements only through approved patient communication workflows.
-
Review patient portal authentication activity
Brandefense recommends checking available application and access logs for repeated use of the same service token or repeated failed PIN validation. Investigate anomalies without collecting unnecessary patient data.
-
Add temporary attempt controls
If immediate upgrading is impossible, Brandefense recommends applying rate limits at a trusted gateway and shortening token validity where supported. These controls do not replace version 8.4.0.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124445?
It is an OpenEMR authentication vulnerability involving reusable one-time service tokens and insufficient PIN attempt controls. Successful exploitation can establish a patient portal session.
Which OpenEMR versions are affected by CVE-2026-124445?
OpenEMR versions from 7.0.1 through releases before 8.4.0 are affected. The vendor identifies version 8.4.0 as patched.
What does an attacker need to exploit CVE-2026-124445?
The attacker must first obtain a valid service authentication token. Some flows also require the associated PIN before the token can establish a portal session.
What should OpenEMR administrators do first?
Upgrade to OpenEMR 8.4.0 or later. Then invalidate outstanding service tokens where possible and review portal authentication activity for repeated token use.
