EUVD-2026-119555

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforceonetimeuse and maxaccesscount flags, never revokes consumed serviceauth tokens, and checks loginpin without rate limiting or strict comparison. Attackers holding a captured token can replay ...