HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67611 — OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allow...

·Source: NIST NVD

Updated:

Executive Summary

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credenti

Analysis

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credentials for an API access token, bypassing the normal web interface authentication and any enforced multi-factor authentication controls. CVSS Score: 8.1. Published: 2026-08-03T17:16:43.880.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67611
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-18613 — A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affe...

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existenc

CVE-2026-18613
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-18612 — A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affec...

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and co

CVE-2026-18612
NIST NVD
CRITICALVulnerability

N-Able Flaw Exposes MSPs to Worst Case Scenario

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/n-able-flaw-exposes-msps-to-worst-case-scenario-image_small-10-a-32397.jpg" align=right hspace=4><b>Remote Management and Monitoring Tools Widely Used by Managed Security Providers</b><br>Remote management and monitoring software developer N-Able published a second hotfix to patch a vulnerability in all versions of its N-central s

Bank Info Security