CVE-2026-24898 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.

Severity & Score

Impact

Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.

Mitigation

Upgrade to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c
• https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2026-24898 - Critical (10) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24898/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner