Server-Side Request Forgery Vulnerability in OpenEMR by OpenEMR
CVE-2026-124466

6.9MEDIUM

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124466?

OpenEMR versions prior to 8.4.0 are susceptible to a server-side request forgery (SSRF) vulnerability, enabling unauthenticated attackers to exploit the system. By registering an OAuth2 client with an unvalidated jwks_uri, attackers can manipulate the server into sending HTTP requests not intended for public exposure. This can be executed via the token introspection endpoint using an unsigned client_assertion, allowing attackers to probe internal services and possibly access sensitive cloud metadata endpoints. Organizations must update their OpenEMR installations to the latest version to defend against potential exploitation.

Affected Version(s)

openemr 0 < 8.4.0

openemr 8.4.0

References

https://github.com/openemr/openemr/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openemr-before-8.4.0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

EvidentObscurity
tinyb0y
giki-shergill
Xcatolin
.