CVE-2026-126427OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form

Beschreibung

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-fc6f-f47r-j9x8) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form third-party-advisory