Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-03 | 3 | Disclosure1General1Patch1 |
| 2026-03-04 | 2 | Disclosure2 |
| 2026-03-06 | 1 | Patch1 |
🚨 CVE-2026-24898 (CVSS: 10.0) OpenEMR 8.0.0以前では、MedExコールバックエンドポイントで未認証ユーザーがAPIトークンを取得可能。これにより、THIRD-PARTYサービス侵害、PHI漏洩、HIPAA違反のリスク。8.0.0に更新で修正。 https://maruomosquit.com/vulnerability/CVE-2026-24898/ #脆弱性 #セキュリティ
Post summary
CVE-2026-24898 allows unauthenticated users to obtain API tokens via the MedEx callback endpoint in OpenEMR versions prior to 8.0.0, risking PHI exposure; upgrading to 8.0.0 resolves the issue.
CVE-2026-24898 Unauthenticated MedEx API Token Disclosure in OpenEMR Versions Prior to 8.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24898
Post summary
The text announces CVE-2026-24898, describing an unauthenticated API token disclosure in OpenEMR versions before 8.0.0, with no additional details on exploitation or mitigation.
🔴 CVE-2026-24898 - Critical OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx cal... https://www.thehackerwire.com/vulnerability/CVE-2026-24898/ https://t.co/SLoJ6azJbG
Post summary
The tweet announces a critical unauthenticated token disclosure vulnerability in OpenEMR versions prior to 8.0.0, linking to a detailed article for more information.
🚨*CVE* CVE-2026-24898 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerabi… https://www.cve.org/CVERecord?id=CVE-2026-24898 ----- Traducción: CVE-2026-24898 Ope… http://infoflow.cloud`
Post summary
The post references CVE-2026-24898, noting an unauthenticated token disclosure vulnerability in OpenEMR versions before 8.0.0, but offers no further technical details, PoC, or mitigation information.
CVE-2026-24898 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerabi… https://www.cve.org/CVERecord?id=CVE-2026-24898
Post summary
The text announces CVE-2026-24898, an unauthenticated token disclosure vulnerability affecting OpenEMR versions before 8.0.0, without providing details on exploitation, mitigation, or PoC.
[CVE-2026-24898: CRITICAL] Vulnerability in OpenEMR < 8.0.0 allows unauthorized access to MedEx API tokens, risking PHI exposure and third-party service compromise. Update to version 8.0.0 for a fix.#cve,CVE-2026-24898,#cybersecurity https://cvefind.com/CVE-2026-24898
Post summary
The post highlights a critical CVE in OpenEMR that allows unauthorized access to MedEx API tokens and advises users to update to version 8.0.0 to mitigate the risk.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |