CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2026-08-03

Updated

2026-08-14

Proof-of-concept exploits (1)

• https://jivasecurity.com/writeups/openemr-preauth-disclosure-password-grant

References

• CVE Record
• NVD entry

Related

• CVE-2026-67610
• CVE-2026-67612
• CVE-2026-67609
• CVE-2026-67617
• CVE-2026-67608
• CVE-2026-67620