OpenEMR versions prior to 8.0.0 contain a critical session expiration vulnerability that allows attackers to maintain unauthorized access to sensitive medical data indefinitely.

This flaw involves insufficient session expiration (CWE-613) where the application fails to enforce logout checks when the skip_timeout_reset parameter is present in a request. This allows an attacker to keep a session active indefinitely, effectively bypassing security controls meant to invalidate expired or abandoned sessions.

The vulnerability poses a severe risk to patient confidentiality and compliance within healthcare environments. By preventing session expiration, unauthorized parties can access sensitive electronic health records on abandoned workstations or leverage stolen session cookies to maintain persistent access to the system. With a CVSS score of 7.5, this high severity flaw could lead to significant data breaches, regulatory non-compliance, and loss of patient trust.

Immediate Action: Upgrade OpenEMR to version 8.0.0 or later immediately to implement the required session management security checks.

Proactive Monitoring: Review application logs for unusual patterns of requests containing the skip_timeout_reset parameter, especially those originating from unexpected IP addresses or occurring outside of normal business hours.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing the skip_timeout_reset parameter if they are not explicitly required for legitimate application functionality.

Public Exploit Available: Unknown

The risk associated with CVE-2026-25476 is significant given the sensitive nature of the data stored within OpenEMR. Administrators must prioritize upgrading to version 8.0.0 to remediate this session bypass flaw. Failure to patch this vulnerability leaves the environment susceptible to unauthorized data access and persistent session hijacking.