OpenEMR Vulnerability in User Session Logout Processing by OpenEMR

CVE-2026-103019

What is CVE-2026-103019?

A significant security vulnerability exists in OpenEMR, an open-source electronic health records and medical management application. The issue arises from the userSessionLogout() function in src/RestControllers/AuthorizationController.php, which improperly processes an id_token_hint without verifying its signature. This flaw allows unauthenticated attackers to create a malicious logout link that redirects users to arbitrary external sites, enabling phishing attacks. The vulnerability is particularly concerning when the OpenEMR REST API is enabled, as this functionality is exposed to exploitation. This security issue has been addressed and resolved in OpenEMR version 8.3.0.

References