HIGHVulnerability

CVE-2026-67610

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

Properties

severity
HIGH
score
8.1
epss_score
0.00326
cve_id
CVE-2026-67610
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
published_at
2026-08-03T17:16:43.703
last_modified
2026-09-09T20:40:01.933
epss_percentile
0.25435

Related Entities (3)

ENRICHED_BY (1)

[Source]FIRST EPSS

DESCRIBED_BY (1)

[Source]NVD

HAS_WEAKNESS (1)

[Weakness]Missing Authentication for Critical Function

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-67610 — Ninja Signal Threat Intelligence | Ninja Signal