CVE-2026-67610

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2026-08-03

Updated

2026-08-14

Proof-of-concept exploits (1)

• https://jivasecurity.com/writeups/openemr-unauth-oauth2-client-registration

References

• CVE Record
• NVD entry

Related

• CVE-2026-67609
• CVE-2026-67611
• CVE-2026-67608
• CVE-2026-67612
• CVE-2026-67602
• CVE-2026-67617