https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T06:43:01.610838+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124445 CVE-2026-124445 — OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force 2026-11-10T06:43:01.611781+00:00

Affected: openemr

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.