CVE-2026-126426

OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfaregistrations.php and mfau2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or...

EUVD-2026-125017

OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfaregistrations.php and mfau2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or...

CVE-2026-126426

OpenEMR versions 5.0.2 before 8.5.0 are vulnerable to a missing authentication flaw in the mfa_registrations.php and mfa_u2f.php components. This allows an attacker who has hijacked a victim's authenticated session to delete existing MFA factors or register new U2F keys without providing a passwo...