CVE-2026-126436OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint

Açıklama

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-qjj7-c4m9-6f92) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint third-party-advisory