CVE-2026-67611 Details

An authentication bypass vulnerability has been identified in OpenEMR versions through 8.2.0. This vulnerability allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow. The issue arises through an unauthenticated client registration endpoint, which attackers can use to register an OAuth2 client and then exchange credentials for an API access token. This bypasses the normal web interface authentication and any enforced multi-factor authentication controls.

Users are advised to disable the OAuth2 password grant option in the OpenEMR server configuration, as it is not considered secure. Additionally, the pre-authentication disclosure surface should be restricted to minimize the information available to potential attackers.