CVE-2021-25923: 
OpenEMR vulnerability analysis and mitigation

OpenEMR versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as the application does not enforce a maximum password length limit. This vulnerability could lead to account takeover if a malicious user knows the first 72 characters of the victim's password (WhiteSource).

The vulnerability exists because OpenEMR does not enforce a maximum password length limit during user creation. The BCRYPT hash algorithm used by the system only processes the first 72 characters of a password, with any additional characters being truncated. This means that if an attacker knows the first 72 characters of a victim's password, they could potentially gain unauthorized access to the account regardless of any additional characters (GitHub). The vulnerability has a CVSS v3.1 base score of 8.1, with Network attack vector, High attack complexity, and No privileges required (WhiteSource).

If successfully exploited, this vulnerability could lead to complete account takeover of affected users. An attacker who knows the first 72 characters of a user's password could gain unauthorized access to the account, potentially compromising the confidentiality and integrity of sensitive medical information (WhiteSource).

The vulnerability can be exploited if a malicious user is aware of the first 72 characters of the victim user's password. A proof of concept demonstrates that signing in with a very long password is successful, but only the first 72 characters are actually used for authentication (WhiteSource).

The vulnerability has been fixed in OpenEMR version 6.0.0.2. Users should upgrade to this version or later to address the issue. The fix includes implementing a maximum password length setting that defaults to 72 characters to match the BCRYPT algorithm's limitation (GitHub).