GHSA-rfg2-wjmm-ph3xMediumCVSS 4.3
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations...
🔗 CVE IDs covered (1)
📋 Description
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.
🔗 References (5)
- https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh
- https://nvd.nist.gov/vuln/detail/CVE-2026-126426
- https://github.com/openemr/openemr/commit/e0dee295497bba763151913bde563a826c739cd7
- https://www.vulncheck.com/advisories/openemr-5.0.2-before-8.5.0-missing-re-authentication-for-mfa-factor-deletion-and-u2f-registration
- https://github.com/advisories/GHSA-rfg2-wjmm-ph3x