CVE-2026-24898: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-24898 is an unauthenticated token disclosure vulnerability in OpenEMR's MedEx callback endpoint, classified as Unauthenticated MedEx Session-Token Disclosure via Callback Endpoint. It affects all OpenEMR versions prior to 8.0.0 and allows any unauthenticated network attacker to retrieve the practice's MedEx API tokens, leading to PHI exfiltration and HIPAA violations. The vulnerability was published on March 3, 2026, and fixed in OpenEMR 8.0.0. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 10.0 (Critical) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is improper authentication (CWE-287) and missing authentication for a critical function (CWE-306), combined with exposure of sensitive information to unauthorized actors (CWE-200). The vulnerable code resides in library/MedEx/MedEx.php (lines 38–47), where $ignoreAuth = true completely bypasses OpenEMR's authentication framework. When any HTTP POST request is received with a callback_key parameter (any non-empty value is accepted without validation), the endpoint instantiates a MedExApi\MedEx object, performs a MedEx login, and returns the full JSON response — including bearer tokens, practice profile data, and patient event metadata — to the unauthenticated caller. No network-level restriction or secret validation is enforced before token disclosure occurs (GitHub Advisory, GitHub Commit).

Successful exploitation allows any unauthenticated attacker to obtain the practice's MedEx API bearer token, enabling complete compromise of the third-party MedEx messaging/reminder platform. Attackers can use the stolen token to exfiltrate Protected Health Information (PHI) — including patient identifiers linked to appointment and reminder events — perform unauthorized actions on the MedEx platform, and trigger server-side database writes (medex_prefs.status, background_services) on each malicious request. The resulting unauthorized PHI access constitutes a direct HIPAA violation with significant regulatory and legal consequences for affected healthcare practices (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, requiring only a single unauthenticated HTTP POST request to /library/MedEx/MedEx.php with any callback_key value. The only prerequisite is that the MedEx service is enabled in the target OpenEMR installation. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.0022 (0.22%), reflecting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing OpenEMR instances (versions < 8.0.0) using search engines like Shodan or Censys, or by probing known OpenEMR URL patterns. Determine if MedEx is enabled by checking for the existence of /library/MedEx/MedEx.php.
2. Send malicious POST request: Issue an unauthenticated HTTP POST request to the vulnerable endpoint with any non-empty callback_key value:

POST /library/MedEx/MedEx.php HTTP/1.1
Host: target-openemr.com
Content-Type: application/x-www-form-urlencoded

callback_key=anything

3. Capture disclosed tokens: Parse the JSON response, which contains the MedEx bearer token, practice profile data, campaign/event metadata, and potentially patient identifiers:

{"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "practice": {"id": "12345", "name": "Medical Clinic"}, "campaigns": {"events": [...]}, "success": "200"}

4. Abuse the stolen token: Use the extracted bearer token to authenticate against the MedEx API (e.g., GET https://MedExBank.com/api/patients) to enumerate patients, exfiltrate PHI, or perform unauthorized actions on the MedEx platform (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /library/MedEx/MedEx.php from external or unknown IP addresses; outbound connections from the OpenEMR server to MedExBank.com triggered by external POST requests rather than scheduled background services.
• Logs: Web server access logs showing POST requests to /library/MedEx/MedEx.php with callback_key in the request body from non-MedEx IP ranges; OpenEMR audit logs (post-patch) showing medex-webhook events with Missing callback key or Sync failed messages from suspicious remote addresses.
• Application: Unexpected entries in medex_prefs.status or background_services database tables corresponding to externally triggered MedEx login round-trips at unusual times.
• API Activity: Anomalous or unauthorized API calls to the MedEx platform (MedExBank.com) using the practice's credentials, particularly patient data queries not initiated by practice staff (GitHub Advisory, GitHub Commit).

The vulnerability is fixed in OpenEMR 8.0.0, which patches library/MedEx/MedEx.php to: return HTTP 404 if MedEx is not enabled (hiding endpoint existence), validate the callback_key before processing, return only success/failure status (never sensitive tokens), and add audit logging for all webhook attempts. Organizations unable to upgrade immediately should implement network-level access controls (e.g., firewall rules or web server configuration) to restrict access to /library/MedEx/MedEx.php to known MedEx server IP addresses only. Additionally, practices should rotate their MedEx API credentials immediately if they suspect exposure (GitHub Advisory, GitHub Commit).

The vulnerability was part of a broader disclosure of 38 security flaws found in OpenEMR, which received coverage from multiple healthcare and information security outlets including BankInfoSecurity, HealthcareInfoSecurity, DataBreachToday, and GovInfoSecurity. The Aisle security research team, credited with discovering the flaws, published a blog post highlighting the critical nature of the vulnerabilities in healthcare software used by over 100,000 providers. Social media activity was noted on Mastodon and Bluesky via automated CVE tracking accounts shortly after disclosure (BankInfoSecurity, Aisle Blog).