CVE-2026-124466 OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

Medium 6.9 Published 8 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124466?

CVE-2026-124466 is a medium-severity vulnerability in openemr, published on 8 Nov 2026.

Official description

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.

Weakness: CWE-918

Which versions are affected by CVE-2026-124466?

How do I fix CVE-2026-124466?

No fix has been published for CVE-2026-124466 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124466 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124466 exists.

Sources

Also known as GHSA-mf6h-xc62-9fg4, GHSA-xj63-9399-3j6q.