CVE-2026-126473 OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.writ...

EUVD-2026-124951

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.writ...

CVE-2026-126473 OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.writ...

CVE-2026-126473

OpenEMR versions prior to 8.4.0 are vulnerable to an OAuth authorization bypass caused by scope canonicalization and containment flaws. This allows unauthenticated attackers to bypass approval processes by registering a colon-form client (e.g., system:Patient.read). Once registered, attackers can...