Description
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | 7.0.1 – < 8.4.0 | 8.4.0 |
References
- GitHub Security Advisory (GHSA-xg3m-9pfq-c8r6) vendor-advisory
- VulnCheck Advisory: OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force third-party-advisory