Vulnerability Description
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://jivasecurity.com/writeups/openemr-preauth-disclosure-password-grant
- https://www.vulncheck.com/advisories/openemr-oauth2-password-grant-authenticatio
FAQ
What is CVE-2026-67611?
CVE-2026-67611 is a vulnerability with a CVSS score of 8.1 (HIGH). OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password g...
How severe is CVE-2026-67611?
CVE-2026-67611 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67611?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.