Missing Authentication for Critical Function in OpenEMR - #VU158844
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to register a U2F security key under their control on a target account without re-entering the account password, making that key an accepted second factor for future logins.
The vulnerability exists due to missing re-authentication for a critical function in OpenEMR's interface/usergroup/mfa_u2f.php when processing U2F key registration requests. A remote user can use a compromised authenticated session and a valid CSRF token to submit a valid U2F registration response to add a key they control to the account's accepted MFA factors.
Subsequent sign-ins still require the account password, and the changes are limited to the account associated with the compromised session.