CVE-2026-67610 openemr CVE debrief

Who should care

Healthcare organizations using OpenEMR, security teams responsible for monitoring and protecting FHIR resources, and administrators who manage OAuth2 client registrations. These stakeholders should verify their exposure, restrict OAuth2 client registration, and monitor FHIR resource access to prevent unauthorized access.

Why it matters

CVE-2026-67610 is a high-severity vulnerability in OpenEMR's OAuth2 dynamic client registration endpoint. Healthcare organizations and security teams should verify their exposure, restrict OAuth2 client registration, and monitor FHIR resource access to prevent unauthorized access.

• Verify OAuth2 client registration restrictions to prevent unauthorized access
• Monitor FHIR resource access for suspicious activity
• Assess exposure and prioritize remediation based on the CVSS score of 8.6

Technical summary

The vulnerability exists in OpenEMR's OAuth2 dynamic client registration endpoint, allowing unauthenticated attackers to register a malicious client with system-level FHIR scopes by providing a self-generated RSA keypair via the jwks field. This allows unauthenticated attackers to register a malicious client with system-level FHIR scopes. Once approved by an administrator, attackers can obtain access tokens granting read access to all FHIR resources across all patients in the system. The vulnerability has a CVSS score of 8.6 and is considered high-severity.

Defensive priority

Healthcare organizations using OpenEMR should verify their version and assess exposure. Restrict OAuth2 client registration to trusted sources and closely monitor FHIR resource access.

Recommended defensive actions

• Verify OpenEMR version and assess exposure
• Restrict OAuth2 client registration to trusted sources
• Monitor FHIR resource access for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, specific affected versions and remediation steps require verification from official sources. OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.