CVE-2026-126427OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form

Descripción

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-fc6f-f47r-j9x8) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form third-party-advisory