CVE-2025-68277: 
OpenEMR vulnerability analysis and mitigation

CVE-2025-68277 is a UI misrepresentation (phishing) vulnerability in OpenEMR, a free and open-source electronic health records and medical practice management application. Prior to version 7.0.4, links sent via the Secure Messaging feature open within the OpenEMR/Portal site rather than navigating the user to the external destination, enabling phishing attacks. All OpenEMR versions before 7.0.4 are affected. The vulnerability was disclosed on February 25, 2026, and carries a CVSS v3.1 score of 5.0 (Medium) and a CVSS v4.0 score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an insufficiently restrictive DOMPurify sanitization configuration in portal/messaging/messages.php, classified as CWE-451 (User Interface Misrepresentation of Critical Information). The renderMessageBody function called DOMPurify.sanitize() with only USE_PROFILES: { html: true }, which preserved anchor (<a>) and image (<img>) tags including their href attributes, allowing external links to load within the OpenEMR/Portal iframe context. An attacker with access to send Secure Messages (e.g., a patient portal user) can craft a message containing a hyperlink to a malicious site; when a clinician or administrator clicks the link inside OpenEMR, the external site renders within the portal frame, masking the true destination (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to deceive OpenEMR users — including clinicians and administrators — into believing they are interacting with a legitimate website while the malicious content is rendered within the trusted OpenEMR portal interface. This can lead to credential theft, unauthorized access to user accounts, and potential exposure of sensitive protected health information (PHI). Given that OpenEMR manages electronic health records, compromised credentials could enable further lateral movement within healthcare systems (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, where the issue was initially reported by a clinician testing OpenEMR 7.0.3 and subsequently replicated in the 7.0.4 development demo using both Chrome and Firefox. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (0.000140), indicating a low probability of near-term exploitation (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Gain portal access: Obtain access to the OpenEMR patient portal as a registered patient or low-privileged user (e.g., using a legitimate or self-registered account).
2. Craft a malicious message: Compose a Secure Message containing an HTML hyperlink pointing to an attacker-controlled phishing page designed to mimic a legitimate healthcare or login portal.
3. Send the message: Deliver the message to a target clinician, administrator, or other OpenEMR user via the Secure Messaging feature.
4. Victim clicks the link: When the recipient opens the message in OpenEMR and clicks the link, the external malicious site loads within the OpenEMR/Portal iframe due to the permissive DOMPurify configuration, making the content appear to originate from within the trusted OpenEMR environment.
5. Harvest credentials or data: The victim, believing they are within the legitimate OpenEMR interface, may enter credentials or sensitive information into the attacker-controlled page, enabling credential theft or further compromise (GitHub Advisory).

• Logs: OpenEMR application logs showing Secure Messages containing anchor tags (<a href=...>) with external URLs sent from patient portal accounts to clinical staff.
• Network: Outbound HTTP/HTTPS requests from the OpenEMR server or client browsers to unexpected external domains originating from within the portal messaging context; iframe loads to non-OpenEMR domains.
• Application Behavior: Users reporting that clicking links in Secure Messages opens external websites within the OpenEMR portal window rather than in a new browser tab or window.

Upgrade OpenEMR to version 7.0.4 or later, which patches the issue by adding FORBID_TAGS: ['a', 'img'] to the DOMPurify sanitization configuration in portal/messaging/messages.php, preventing anchor and image tags from rendering in Secure Messages (Patch Commit). As an interim workaround prior to patching, administrators should educate users to verify the browser address bar URL before entering any credentials when accessing links from Secure Messaging. Security awareness training focused on phishing recognition is also recommended for all OpenEMR portal users (GitHub Advisory).

The vulnerability was initially reported by a clinician who discovered the behavior during routine testing of OpenEMR 7.0.3, and was credited in the advisory as margarethaywood. The fix was developed by stephenwaite and committed by bradymiller, the OpenEMR project lead. No significant broader media coverage or notable external researcher commentary has been identified beyond the official GitHub Security Advisory (GitHub Advisory).