Read the docs
TI-2026-85648 Aliases CVE-2026-103021

Username enumeration in OpenEMR via pre-login user settings

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

OpenEMR from 6.0.0 before 8.3.0 loads the user settings of any account named in the unauthenticated authUser login parameter before authentication succeeds. Existing usernames trigger extra database work and may show customized settings, an observable discrepancy tied to CWE-203. A remote unauthenticated attacker can use timing or page differences to enumerate valid accounts for later credential attacks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

Why it matters now

EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed openemr (openemr): 8.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
openemropenemr6.0.0 to before 8.3.08.3.0Patch availableCNA
  • openemr Vendoropenemr Affected 6.0.0 to before 8.3.0 Fixed in 8.3.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*——Open-Emr
  • cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* Versions — — ·Open-Emr

Remediation

Upgrade OpenEMR to version 8.3.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA openemr (openemr) Fixed in 8.3.0

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-103021

References

Other 4

  • TI-2026-24664 SQL Injection Vulnerability in ajax graphs library (OpenEMR) CVSS 3.1HIGH 8.8
  • TI-2026-85645 Missing write ACL lets users reassign documents in OpenEMR CVSS 3.1CRITICAL 9.6
  • TI-2026-28796 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection CVSS 4.0CRITICAL 9.4
  • TI-2026-20308 OpenEMR's payments gateway_api_key secret rendered into client JS code CVSS 3.1CRITICAL 9.6
  • TI-2026-20093 OpenEMR has SQL Injection in Patient API Sort Parameter CVSS 3.1CRITICAL 10.0
  • TI-2026-20048 OpenEMR Arbitrary File Read Vulnerability CVSS 3.1CRITICAL 10.0
See all 153 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences