CVE-2026-24898
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
- Affected products
- Openemr
- Open-emr Openemr
- < 8.0.0
- Fix
- Available
- CVSS 3.1
- 10.0 CRITICAL
- EPSS
- 0.6% (44th percentile)
- Weakness
- CWE-287
- NVD status
- Analyzed
- Published
- 2026-03-03
No indexed exploits for CVE-2026-24898 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-24898 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.