What is GHSA-jqqh-x5q5-wvhp?

GHSA-jqqh-x5q5-wvhp is a security advisory published by GitHub Security Advisories with Critical severity. OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow...

Which CVE IDs does GHSA-jqqh-x5q5-wvhp cover?

GHSA-jqqh-x5q5-wvhp covers the following CVE IDs: CVE-2026-126473. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jqqh-x5q5-wvhp?

GHSA-jqqh-x5q5-wvhp has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-jqqh-x5q5-wvhpCriticalCVSS 9.1

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126473 →

📋 Description

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

🔗 References (4)

https://github.com/openemr/openemr/security/advisories/GHSA-6xh3-fmm5-jjp4
https://nvd.nist.gov/vuln/detail/CVE-2026-126473
https://www.vulncheck.com/advisories/openemr-before-8.4.0-oauth-authorization-bypass-via-scope-canonicalization
https://github.com/advisories/GHSA-jqqh-x5q5-wvhp