CVE-2026-126454 json
OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2
published 18d ago modified 2d ago also EUVD-2026-124969 , GHSA-rp7c-25mm-8g74
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository openemr/openemr. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication.
Patch / fix
- openemr openemr 8.5.0
Is CVE-2026-126454 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
- openemr openemr
Classification
- Weakness
-
- CWE-307 Improper Restriction of Excessive Authentication Attempts
References
-
github.com
/openemr/openemr/security/advisories/GHSA-rp7c-25mm-8g74
vendor-advisory, advisory
-
vulncheck.com
/advisories/openemr-before-8.5.0-totp-brute-force-via-main-screen-php-and-oauth2
third-party-advisory
Sources
- CVE List CVE-2026-126454
- NVD CVE-2026-126454
- Maintainer advisory GHSA-rp7c-25mm-8g74
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of openemr/openemr published their own advisory on GitHub. Reviewed sources take precedence over it.