CVE-2026-67610: Openemr

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

Affected products

• Openemr Openemr: up to and including 8.2.0

Published 2026-08-03. Last modified 2026-09-09.