Dashboard / CVE-2026-103019

CVE-2026-103019

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 59/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Unchanged
C: None
I: Low
A: None

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout() in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id_token_hint without verifying its signature and, when the referenced trusted session is absent, redirects to the caller-supplied post_logout_redirect_uri before validating it against the client's registered redirect URIs. An unauthenticated attacker can craft a logout link that sends a user to an arbitrary external site and invalidates the user's session, enabling convincing phishing flows from the legitimate logout endpoint. The endpoint is reachable when the OpenEMR REST API is enabled. This issue is fixed in version 8.3.0.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
open-emr openemr < 8.3.0
openemr openemr < 8.3.0
openemr openemr < 8.3.0

References & Advisories (4)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.71%
Raw Score 0.007060
Percentile 53.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00706
2026-11-13
0.00706
2026-11-12
0.00706
2026-11-10
0.00263
2026-11-09
0.00263
2026-11-08
0.00263
2026-11-07
0.00263
2026-11-06
0.00263

Intelligence Sources

mitre ref →
nvd ref →

External Links