CVE-2026-126473

CVSS 9.3 (critical) · published 2026-11-13

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

Weakness: CWE-863

Source: NVD CVE-2026-126473

References

• https://github.com/openemr/openemr/security/advisories/GHSA-6xh3-fmm5-jjp4
• https://www.vulncheck.com/advisories/openemr-before-8.4.0-oauth-authorization-bypass-via-scope-canonicalization
• https://github.com/openemr/openemr/security/advisories/GHSA-6xh3-fmm5-jjp4

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.