CVE-2026-124466

HIGH 7.2

OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.

CWE	CWE-918
Vendor	openemr
Product	openemr
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openemr openemr

Be the first to know when new high vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

openemr / openemr

0 < 8.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openemr/openemr/security/advisories/GHSA-mf6h-xc62-9fg4 vulncheck.com: https://www.vulncheck.com/advisories/openemr-before-8.4.0-unauthenticated-ssrf-via-oauth2-client-jwks-uri

Credits

EvidentObscurity tinyb0y giki-shergill Xcatolin