What’s Vulnerable › Vulnerabilities

CVE-2026-67610: OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-09-09
• Weakness: CWE-306

Description

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

Affected products

• openemr: through 8.2.0

References

• https://jivasecurity.com/writeups/openemr-unauth-oauth2-client-registration
• https://www.vulncheck.com/advisories/openemr-oauth2-dynamic-client-registration-unauthorized-fhir-access

Get alerted when CVE-2026-67610 or the next vulnerability affects your stack