An authentication brute force vulnerability in OpenEMR version 7.0.1 allows unauthenticated attackers to bypass rate limiting protections and compromise user accounts.

This flaw is classified under CWE-307 as Improper Restriction of Excessive Authentication Attempts, where unauthenticated attackers can send repeated POST requests to the main login endpoint using authUser and clearPass parameters without triggering account lockouts.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive patient records and administrative functions, resulting in severe data compromise, regulatory non-compliance, and reputational damage. The assigned CVSS score of 7.5 reflects the high severity of remote confidentiality impacts achievable via automated credential guessing.

Immediate Action: Apply official vendor security updates or patches as soon as they become available from the OpenEMR project.

Proactive Monitoring: Monitor authentication logs for unusual spikes in failed login attempts or repeated POST requests originating from single IP addresses targeting the login endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rate limiting rules and account lockout policies at the network perimeter to block automated brute force attacks.

Public Exploit Available: Yes, an exploit reference is available via Exploit-DB entry 51413.

Given the high severity and the presence of public exploit material, organizations running OpenEMR 7.0.1 must prioritize securing their login endpoints. Apply available vendor guidance or patches immediately, and enforce strict network monitoring and rate limiting to prevent unauthorized access.