CVE-2026-33934: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33934 is a missing authorization vulnerability in OpenEMR's patient portal signature retrieval endpoint (portal/sign/lib/show-signature.php) that allows any authenticated patient portal user to read the drawn signature image and full name of any staff member by supplying an arbitrary user value in the POST body. It affects all OpenEMR versions prior to 8.0.0.3 (i.e., ≤ 8.0.0.2). The vulnerability was published on March 25–26, 2026, and patched in version 8.0.0.3 released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). In show-signature.php, when handling a portal request (is_portal=1), the code correctly rebinds $req_pid to the authenticated patient's session PID but never rebinds the $user variable — it remains whatever the caller supplied in the JSON POST body. The non-portal auth block that validates $user against $_SESSION['authUserID'] is entirely skipped when $isPortal is truthy. Additionally, the $type parameter is not restricted, allowing portal patients to request type=admin-signature, which queries the onsite_signatures table using the attacker-controlled $user value and returns the staff member's base64-encoded PNG signature. The companion write endpoint (save-signature.php) had already been hardened against this same issue, and three client-side guards in signer_api.js block admin-signature requests in portal mode — but none of these protections were applied server-side to the read endpoint (GitHub Advisory, Patch Commit).

Any authenticated patient portal user can retrieve the drawn signature image (base64-encoded PNG) and full name of any staff member without authorization. Because staff user IDs are sequential integers, enumeration of all staff signatures is trivial. When the endpoint is called in fetch_info mode, it additionally discloses the staff member's full name from the users table. This represents an unauthorized crossover from the patient portal session context into clinical/staff data, affecting all OpenEMR deployments with the patient portal enabled. There is no integrity or availability impact, but the confidentiality exposure of staff signature data in a healthcare context carries regulatory and compliance implications (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, providing concrete step-by-step instructions and a specific JSON payload. The EPSS score is approximately 0.025% (0.000250), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid patient portal account, making the attack accessible to any registered patient (GitHub Advisory).

1. Obtain portal credentials: Register or log into the OpenEMR patient portal with any valid patient account.
2. Capture session cookie: After login, capture the session cookie from the browser (e.g., via browser developer tools or a proxy like Burp Suite).
3. Send crafted POST request: From the browser console on any portal page, or using curl with the session cookie, send a POST request to /portal/sign/lib/show-signature.php with the following JSON body:

{"pid": 0, "user": "1", "type": "admin-signature", "is_portal": 1}

4. Retrieve staff signature: If staff user ID 1 has a filed signature, the response contains their base64-encoded drawn signature image (PNG).
5. Enumerate staff members: Increment the user value (e.g., "user": "2", "user": "3", etc.) to enumerate and retrieve signatures for all staff members.
6. Obtain staff names: Use mode=fetch_info in the request to additionally retrieve the staff member's full name from the users table (GitHub Advisory).

• Network: Repeated POST requests to /portal/sign/lib/show-signature.php from a patient portal session, especially with incrementing user values in the JSON body; requests containing "type": "admin-signature" and "is_portal": 1 from portal-authenticated sessions.
• Logs: Web server access logs showing multiple POST requests to /portal/sign/lib/show-signature.php from the same session or IP address with varying user parameter values; responses with large base64-encoded payloads (PNG signature data) returned to portal users.
• Application Logs: OpenEMR application logs (if verbose logging is enabled) showing portal session access to the signature endpoint with non-patient user IDs in the request body (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.3 or later, which patches this issue by rebinding $user to $req_pid for portal sessions and explicitly blocking admin-signature type requests from portal users (OpenEMR Release, Patch Commit). As a temporary workaround if immediate upgrade is not possible, implement network-level access controls to restrict direct access to the portal/sign/lib/ directory to authorized users only, or disable the patient portal entirely until patching is feasible. The security advisory (GHSA-w9w5-7x6h-657q) can also be referenced for applying the specific code-level fix manually (GitHub Advisory).

The vulnerability was discovered and reported by researchers pavelkohout396, stanislavfortaisle, and simecek, with remediation development credited to kojiromike (GitHub Advisory). Aisle published a blog post noting the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers, which appears to include this and related OpenEMR findings. Red Hat also tracked the CVE in their security database. No significant broader social media or media coverage specific to this individual CVE has been identified.