CVE-2026-126436OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint

Beschreibung

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-qjj7-c4m9-6f92) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint third-party-advisory