A critical authentication bypass in OpenEMR allows unauthenticated attackers to register OAuth2 clients and gain unauthorized access to protected patient data.

This vulnerability (CWE-306) stems from missing authentication for critical dynamic client registration functions within the OAuth2 implementation. An unauthenticated attacker can register a malicious client, subsequently gaining unauthorized access to FHIR (Fast Healthcare Interoperability Resources) data.

The CVSS score of 8.1 underscores the risk to sensitive medical data. Successful exploitation could lead to massive unauthorized access to Protected Health Information (PHI), resulting in severe regulatory penalties, loss of patient trust, and significant legal liability for healthcare providers utilizing the platform.

Immediate Action: Upgrade OpenEMR to the latest version that includes the patched OAuth2 registration logic.

Proactive Monitoring: Review OAuth2 client registration logs for any suspicious or unauthorized applications appearing in the system.

Compensating Controls: Restrict access to the OpenEMR instance by limiting network visibility and employing a Web Application Firewall to block unauthorized registration requests.

Public Exploit Available: Unknown.

This vulnerability presents a direct risk to patient privacy and regulatory compliance. Healthcare organizations must treat this as an urgent update, ensuring that all OpenEMR instances are patched and that access controls are rigorously audited to prevent unauthorized data exposure.