What is GHSA-9cwc-jcxx-r43v?

GHSA-9cwc-jcxx-r43v is a security advisory published by GitHub Security Advisories with Critical severity. OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores...

Which CVE IDs does GHSA-9cwc-jcxx-r43v cover?

GHSA-9cwc-jcxx-r43v covers the following CVE IDs: CVE-2026-124445. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9cwc-jcxx-r43v?

GHSA-9cwc-jcxx-r43v has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-9cwc-jcxx-r43vCriticalCVSS 9.8

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-124445 →

📋 Description

OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.

🔗 References (4)

https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6
https://nvd.nist.gov/vuln/detail/CVE-2026-124445
https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force
https://github.com/advisories/GHSA-9cwc-jcxx-r43v