CVE-2026-103019

Prior to version 8.3.0 , OpenEMR is vulnerable to an unauthenticated open redirect via the OIDC End Session Endpoint. The root cause is located in src/RestControllers/AuthorizationController.php within the userSessionLogout() function, where decodeToken() processes an id_token_hint without signat...