EUVD-2026-119555

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforceonetimeuse and maxaccesscount flags, never revokes consumed serviceauth tokens, and checks loginpin without rate limiting or strict comparison. Attackers holding a captured token can replay ...

CVE-2026-124445

OpenEMR versions 7.0.1 before 8.4.0 are vulnerable due to a flaw in src/Common/Auth/OneTimeAuth.php . The application fails to respect the enforce_onetime_use and max_access_count flags, fails to revoke consumed service_auth tokens, and lacks rate limiting or strict comparison for login_pin check...

PT-2026-139961

Name of the Vulnerable Software and Affected Versions OpenEMR versions 7.0.1 through 8.3.x Description A flaw exists in the src/Common/Auth/OneTimeAuth.php file where the system ignores the enforce onetime use and max access count flags. Additionally, the system fails to revoke consumed service...

CVE-2026-124445: openemr: OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use…

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforceonetimeuse and maxaccesscount flags, never revokes consumed serviceauth tokens, and checks loginpin without rate limiting or strict comparison. Attackers holding a captured token can replay ...