CVE-2026-25476 OpenEMR has Session Timeout Bypass via skip_timeout_reset

High 7.5 Published 25 Feb 2026 Updated 26 Feb 2026

Attackers can bypass session timeout checks by sending a specific parameter, allowing indefinite access to expired sessions and sensitive medical data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-25476?

CVE-2026-25476 is a high-severity vulnerability in Open-Emr Openemr, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `SessionTracker::isSessionExpired()` and forces logout on timeout is skipped. As a result, any request that includes this parameter (e.g. from auto-refresh pages like the Patient Flow Board) never runs the expiration check: expired sessions can continue to access data indefinitely, abandoned workstations stay active, and an attacker with a stolen session cookie can keep sending `skip_timeout_reset=1` to avoid being logged out. Version 8.0.0 fixes the issue.

Weakness: CWE-613

Which versions are affected by CVE-2026-25476?

It affects 1 product.

Products include Open-Emr Openemr.

How do I fix CVE-2026-25476?

No fix has been published for CVE-2026-25476 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-25476 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25476 exists.

All Open-Emr Openemr vulnerabilities

Sources

Also known as GHSA-gx7q-6fhr-5h33.