What’s Vulnerable › Vulnerabilities

CVE-2023-54347: OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-05 · updated 2026-10-28
• Weakness: CWE-307

Description

OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions.

Affected products

• openemr: 7.0.1 (and their updates)

References

• https://github.com/openemr/openemr/archive/refs/tags/v7_0_1.tar.gz
• https://www.exploit-db.com/exploits/51413
• https://www.open-emr.org/
• https://www.vulncheck.com/advisories/openemr-authentication-brute-force-mitigation-bypass

Get alerted when CVE-2023-54347 or the next vulnerability affects your stack