CVE-2026-24898 OpenEMR has an Unauthenticated MedEx Token Disclosure
Unauthenticated attackers can obtain MedEx API tokens via a callback endpoint, enabling PHI exfiltration and third-party service compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24898?
CVE-2026-24898 is a critical vulnerability in Open-Emr Openemr, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-24898?
It affects 1 product.
Products include Open-Emr Openemr.
How do I fix CVE-2026-24898?
No fix has been published for CVE-2026-24898 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-24898 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24898 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Open-Emr Openemr
Sources
Also known as GHSA-qwff-3mw7-7rc7.