OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure

OpenEMR 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callbackkey. id: CVE-2026-24898 info:...