CVE-2026-124445

OpenEMR versions 7.0.1 before 8.4.0 are vulnerable due to a flaw in src/Common/Auth/OneTimeAuth.php . The application fails to respect the enforce_onetime_use and max_access_count flags, fails to revoke consumed service_auth tokens, and lacks rate limiting or strict comparison for login_pin check...