Authentication Bypass Vulnerability in OpenEMR by OpenEMR

CVE-2026-103021

What is CVE-2026-103021?

OpenEMR, a widely used electronic health records system, contains an authentication bypass vulnerability in its user login process. The issue arises between versions 6.0.0 and 8.3.0, where the unauthenticated 'authUser' parameter allows a remote attacker to exploit timing or page rendering variations. By providing valid usernames, an attacker can trigger additional database queries, revealing user-specific settings even before authentication is completed. This could potentially lead to account enumeration and subsequent credential attacks. The vulnerability is addressed and resolved in version 8.3.0.

References