# CVE-2026-124445

OpenEMR token replay and PIN brute-force allows patient-portal takeover and PHI exposure.

- Page: https://www.vulneraibility.com/cve/CVE-2026-124445
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-307
- Published: 2026-11-08

## Affected versions

- openemr: affected >= 7.0.1 and < 8.4.0; fixed in 8.4.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attackers can replay non-revoked one-time tokens or brute-force PINs to open patient-portal sessions and access PHI.

## Action

Immediate action required

## Recommendation

Revoke existing tokens, enforce rate limiting/strict PIN checks, isolate affected instances, apply vendor patch/upgrade when published.

## References

- [advisory] https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6
- [advisory] https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.