CVE-2026-124451

OpenEMR versions prior to 8.4.0 are vulnerable to an authorization bypass within its SMART on FHIR implementation. The root cause is located in BearerTokenAuthorizationStrategy.php, where the checkUserHasAccessToPatient() function unconditionally returns true. This flaw allows authenticated users...

EUVD-2026-119509

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...

PT-2026-139967

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...

CVE-2026-124451: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because…

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...